Subdomain Takeover

SKILL: Subdomain Takeover — Detection & Exploitation Playbook

AI LOAD INSTRUCTION: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the resource behind the CNAME is unclaimed and claimable.

0. RELATED ROUTING

• ssrf-server-side-request-forgery when a subdomain takeover is used to bypass SSRF allowlists trusting *.target.com
• cors-cross-origin-misconfiguration when CORS trusts *.target.com — takeover → full cross-origin read
• xss-cross-site-scripting takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse)
• http-host-header-attacks when Host routing leads to subdomain-scoped cache or auth issues
• web-cache-deception when a taken-over subdomain shares cache with the main domain

1. CORE CONCEPT

Subdomain takeover occurs when:

1. sub.target.com has a DNS record (CNAME, NS, A) pointing to an external service
2. The external resource is no longer provisioned (deleted S3 bucket, removed Heroku app, etc.)
3. The attacker can register/claim that exact resource name on the provider
4. The attacker now controls content served under sub.target.com

Impact: cookie theft (parent domain cookies), OAuth token interception, phishing under trusted domain, CORS bypass, CSP bypass via whitelisted subdomain.

2. DETECTION METHODOLOGY

2.1 CNAME Enumeration

1. Collect subdomains (amass, subfinder, assetfinder, crt.sh, SecurityTrails)
2. Resolve DNS for each:
   dig CNAME sub.target.com +short
3. For each CNAME → check if the CNAME target returns NXDOMAIN or a provider error
4. Match error response against fingerprint table (Section 3)

2.2 Key Signals

2.3 Automated Tools

3. SERVICE PROVIDER FINGERPRINT TABLE

4. TAKEOVER PROCEDURE — COMMON PROVIDERS

4.1 AWS S3

1. Confirm: curl -s http://sub.target.com → "NoSuchBucket"
2. Extract bucket name from CNAME (e.g., sub.target.com.s3.amazonaws.com → bucket = "sub.target.com")
3. aws s3 mb s3://sub.target.com --region <region>
4. Upload index.html proving control
5. Enable static website hosting

4.2 GitHub Pages

1. Confirm: curl -s https://sub.target.com → "There isn't a GitHub Pages site here"
2. Create GitHub repo (any name)
3. Add CNAME file containing "sub.target.com"
4. Enable GitHub Pages in repo settings
5. Wait for DNS propagation (GitHub verifies CNAME match)

4.3 Heroku

1. Confirm: curl -s http://sub.target.com → "No such app"
2. heroku create <app-name-from-cname>
3. heroku domains:add sub.target.com
4. Deploy proof-of-concept page

5. NS TAKEOVER — HIGH SEVERITY

NS takeover is far more dangerous than CNAME takeover: you control all DNS resolution for the zone.

How It Happens

target.com NS → ns1.expireddomain.com
                 ↓
attacker registers expireddomain.com
                 ↓
attacker now controls ALL DNS for target.com
(A records, MX records, TXT records — everything)

Detection

1. Enumerate NS records: dig NS target.com +short
2. Check each NS domain: whois ns1.example.com → is the domain expired or available?
3. Also check: dig A ns1.example.com → NXDOMAIN/SERVFAIL?
4. Subdelegated zones: check NS for sub.target.com specifically

Impact

• Full domain takeover (serve any content, intercept email, issue TLS certs via DNS-01)
• Issue DV certificates from any CA using DNS challenge
• Modify SPF/DKIM/DMARC → send authenticated email as target

6. MX TAKEOVER — EMAIL INTERCEPTION

When MX records point to deprovisioned mail services:

target.com MX → mail.deadservice.com (service discontinued)

If attacker can claim mail.deadservice.com or the mail tenant:

• Receive password reset emails
• Intercept sensitive communications
• Potentially reset accounts that use email-based auth

Common Scenario

Expired Google Workspace / Microsoft 365 tenant → MX still points to Google/Microsoft → attacker creates new tenant and claims the domain.

7. WILDCARD DNS RISKS

If *.target.com has a wildcard CNAME to a claimable service:

• Every undefined subdomain is vulnerable
• anything.target.com can be taken over
• Massively increases attack surface

Detection: dig A random1234567.target.com — if it resolves, wildcard exists.

8. DETECTION & EXPLOITATION DECISION TREE

Subdomain discovered (sub.target.com)?
├── Resolve DNS records
│   ├── Has CNAME → external service?
│   │   ├── HTTP response matches known fingerprint? (Section 3)
│   │   │   ├── YES → Attempt claim on provider (Section 4)
│   │   │   │   ├── Claim successful → TAKEOVER CONFIRMED
│   │   │   │   └── Claim blocked (name reserved, region locked) → document, try variations
│   │   │   └── NO → Service active, no takeover
│   │   └── CNAME target NXDOMAIN?
│   │       ├── Target is a registrable domain? → Register it → full control
│   │       └── Target is a subdomain of active provider → check provider claim process
│   │
│   ├── Has NS records → external nameserver?
│   │   ├── NS domain expired/available? → Register → FULL ZONE TAKEOVER
│   │   └── NS domain active → no takeover
│   │
│   ├── Has MX → external mail service?
│   │   ├── Mail service deprovisioned/claimable? → Claim tenant → EMAIL INTERCEPTION