Subdomains → CNAME → takeover

Enumerate, extract CNAMEs, fingerprint dangling services. Verify by hand before you touch a claim.

Level: intermediate

Tools: subfinder, dnsx, nuclei, subzy

Pipeline

subfinder -d {domain} -all -silent | dnsx -cname -resp -silent | tee cnames.txt | nuclei -t http/takeovers/ -o takeover.txt

`/`	Focus search on this page
`Ctrl` `K`	Search everything (command palette)
`1`-`9`	Hunt / field / bench / intel (see clusters)
`0`	AI / MCP connector
`j` / `k`	Move selection down / up
`Enter`	Expand / open selected
`c`	Copy primary command of selected
`f`	Toggle favorite on selected tool
`Esc`	Clear search / close