# Subdomain Takeover

> Exploit dangling DNS records pointing to unclaimed cloud/SaaS resources to hijack subdomains, serve malicious content, or steal session cookies.

- **URL:** https://hackindex.io/services/web/exploitation/subdomain-takeover
- **Path:** HTTP/HTTPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/web/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Subdomain takeover occurs when a DNS record (typically a CNAME) points to an external service that has been deprovisioned. If the attacker can register the same resource name on that external service, they control the content served on the target's subdomain. This enables phishing, cookie theft (if the parent domain sets cookies on `*.target.com`), and bypassing domain-based security controls like CSP and CORS.

## Identifying Dangling CNAMEs

Look for subdomains that CNAME to external services (AWS, Azure, GitHub Pages, Heroku, etc.) where the destination resource no longer exists.

**Check CNAME records**

```bash
dig CNAME staging.target.com +short
# staging-target.herokuapp.com.
```

**Verify the resource is unclaimed**

```bash
curl -s -o /dev/null -w '%{http_code}' https://staging.target.com
# 404
```

## Automated Scanning

**Scan with subjack**

```bash
subjack -w subdomains.txt -t 50 -timeout 30 -ssl -o results.txt
# [VULNERABLE] staging.target.com - CNAME: staging-target.herokuapp.com - Heroku
```

**Alternative: nuclei subdomain takeover templates**

```bash
nuclei -l subdomains.txt -t takeovers/
```

## Common Vulnerable Services

Services where a dangling CNAME is exploitable:

- **GitHub Pages**: "There isn't a GitHub Pages site here." Create a repo with a CNAME file matching the subdomain.
- **Heroku**: "No such app." Create an app with the matching name.
- **AWS S3**: "NoSuchBucket." Create a bucket with the matching name.
- **Azure**: various (azurewebsites.net, blob.core.windows.net, cloudapp.azure.com). Register the resource name.
- **Shopify**: "Sorry, this shop is currently unavailable." Register a Shopify store and add the custom domain.
- **Fastly**: "Fastly error: unknown domain." Add the domain to a Fastly service.
- **Pantheon**: "404 error unknown site."
- **Unbounce**: "The requested URL was not found on this server."

## Claiming the Subdomain (GitHub Pages Example)

**Create a GitHub Pages site for the subdomain**

```bash
mkdir takeover && cd takeover
echo 'Subdomain takeover PoC' > index.html
echo 'staging.target.com' > CNAME
git init && git add . && git commit -m 'takeover poc'
git remote add origin https://github.com/youraccount/takeover.git
git push -u origin main
```

## Impact Escalation

Beyond serving content, subdomain takeover enables:

- **Cookie theft**: if the parent domain sets cookies on `.target.com`, your subdomain receives them.
- **CSP bypass**: if the CSP allows `*.target.com`, your subdomain can host scripts that execute on the main domain.
- **OAuth token theft**: if the subdomain is whitelisted as a redirect URI in an OAuth configuration.
- **Phishing**: serve a login page on a legitimate subdomain to capture credentials.

## References

- [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) - Comprehensive list of services vulnerable to subdomain takeover with fingerprints.
- [MDN: Subdomain Takeovers](https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers) - Mozilla's guide on subdomain takeover risks and prevention.