Skip to content
HackIndex logo

HackIndex

Subdomain Takeover Exploitation

2 min read Mar 11, 2026

A subdomain takeover occurs when a DNS record, typically a CNAME, points to a third-party service where the target organization has released the resource but left the DNS routing intact. You exploit this by registering the abandoned resource name at the third-party provider, effectively gaining control over the target's subdomain.

Confirming the Dangling CNAME

Before attempting registration, confirm the CNAME resolves to an unregistered endpoint at a known provider like AWS S3, GitHub Pages, or Azure.

┌──(kali㉿kali)-[~]
└─$ dig @$TARGET_IP $DOMAIN CNAME 
target-marketing.$DOMAIN. 3600 IN CNAME unused-bucket.s3.amazonaws.com.

If the third-party service returns an error like "NoSuchBucket" or "404 Not Found" when navigating to the subdomain, the resource is likely available for registration.

Claiming the Resource

Exploitation requires interacting directly with the third-party cloud provider rather than the target's DNS server.

Log into the corresponding cloud provider portal. Create the resource matching the exact name specified in the dangling CNAME. For example, create an S3 bucket named unused-bucket or an Azure App Service with the designated app name.

Configure the new resource to serve a static HTML proof-of-concept file.

Verifying the Takeover

Once the third-party resource is provisioned and propagating, request the target subdomain to confirm your content is served.

┌──(kali㉿kali)-[~]
└─$ curl -s http://target-marketing.$DOMAIN | grep "Takeover"

A successful response proves you control the web content for the subdomain. You can now use this trusted domain context to bypass Same-Origin Policy (SOP), harvest session cookies, or host authoritative phishing pages targeting the organization's users.