vulns.co
/
GKData.io MCP

Back to Workflows

Subdomains → CNAME → takeover

Enumerate, extract CNAMEs, fingerprint dangling services. Verify by hand before you touch a claim.

Level: intermediate

Tools: subfinder, dnsx, nuclei, subzy

Pipeline

subfinder -d {domain} -all -silent | dnsx -cname -resp -silent | tee cnames.txt | nuclei -t http/takeovers/ -o takeover.txt