subdomain-takeover-hunt

1# Subdomain Takeover Detection
2 
3Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.
4 
5## When to Use
6 
7- Subdomain enumeration produces a large list — scan for lingering DNS records.
8- Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
9- A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
10- The CNAME target is a service with user-registrable names.
11 
12## Prerequisites
13 
14- `terminal` with curl, dnsx, subfinder.
15- `subzy` or `subjack` installed for automated detection.
16- List of alive subdomains from `subdomain-enumeration`.
17 
18## How to Run
19 
20```bash
21# DNS resolution with CNAME extraction
22dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt
23 
24# Automated takeover scan
25subzy run --targets alive_subs.txt --hide_fails --vuln
26```
27 
28## Quick Detection
29 
30```bash
31# DNS resolution with CNAME extraction
32dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt
33 
34# Automated takeover scan
35subzy run --targets alive_subs.txt --hide_fails --vuln
36```
37 
38## Procedure
39 
40### Phase 1 — Extract CNAME Records
41 
42```bash
43# Get all CNAME records
44cat alive_subs.txt | dnsx -silent -cname -resp-only > cname_targets.txt
45 
46# Filter to suspicious services
47…