Subdomain Takeover

Last modified: 2023-06-25


Subdomain Takeover is a malicious activity that the victim’s subdomain allows attackers to control and impersonate.


  • dnsReaper

    git clone
    cd dnsReaper
    python3 -m venv venv
    source venv/bin/activate
    pip3 install -r requirements.txt
    # Fetching from AWS
    python3 aws --aws-access-key-id AWS_ACCESS_KEY_ID --domain
    # Fetching from Azure
    python3 azure --az-subscription-id AZ_SUBSCRIPTION_ID --domain
    # Reading BIND zone file
    python3 bind --bind-zone-file /path/to/zone/file --domain
    # Fetching from Cloudflare
    python3 cloudflare --cloudflare-token CLOUDFLARE_TOKEN --domain
    # Fetching from DigitalOcean
    python3 digitalocean --do-api-key DO_API_KEY --domain
    # Reading specific file
    python3 file --filename /path/to/file --domain
    # Scanning a single domain
    python3 singla --domain --domain

Testing - A, CNAME Subdomain Takeover

1. Enumerate Subdomains

There are various ways to enumerate subdomains.

subfinder -d

./ -d

Please refer to Subdomain Discovery to check more details.

2. Identify Misconfigurations for Subdomains

Check DNS records for identifying what’s on the destination of the subdomain.

dig A

Also we can try to access them with web browser or command-line. For example,

# -L: Follow redirect
# -v: Verbose mode
curl -Lv
curl -v
curl -v

3. Spoof with the Subdomain

If a certain subdomain can be accessible but the error page of the specific provider (e.g. GitHub, Google Cloud, Wix, etc.) appeared, it means that the subdomain of the settings in the service provider was removed but the DNS record (e.g. A, CNAME) remains yet.

In short, attackers can spoof as a legitimate site by claiming this subdomain in the provider.

Here’s an abstract example:

  1. Login the target provider.
  2. Create a malicious website.
  3. Add the target subdomain (e.g. as custom domain in the setting page.
  4. If users visit, they have now visited a malicious website created by an attacker.

Testing - NS Subdomain Takeover

It’s more dangerous If NS record is vulnerable because if the nameserver is taken over, an attacker can take full control of victim’s domains.

To gather NS records for the target domain, use dig command.

dig ns +short

# Result examples

Next, check if the gathered domains can be purchased with domain name registrar like GoDaddy, NameCheap.

For example, search []( in the domain search page of NameCheap. If this domain can be purchased, attackers can buy this domain then take control the name resolution of a victim by creating the custom nameserver which pointed to this domain.