Attack Subdomain Takeover
DevOps & Securityattack-subdomain-takeoverAttack Subdomain Takeover is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Subdomain takeover — CNAME detection, cloud service fingerprinting, dangling DNS exploitation
QUICK START
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/attack-subdomain-takeover/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/attack-subdomain-takeover, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Subdomain Takeover
Objective
Identify subdomains with dangling DNS records (CNAME pointing to unclaimed cloud resources) and claim them to serve attacker content.
Testing Methodology
Phase 1: Subdomain Enumeration
# Passive enumeration
subfinder -d TARGET.com -silent | tee subdomains.txt
# Certificate transparency
curl -s "https://crt.sh/?q=%25.TARGET.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt
# DNS brute force
puredns bruteforce wordlist.txt TARGET.com -r resolvers.txt >> subdomains.txt
Phase 2: Automated Takeover Check
# Check all subdomains for takeover
attack_script subdomain_takeover subdomains.txt --json-output
Checks 20 cloud services:
- GitHub Pages, Heroku, Shopify, Tumblr, WordPress
- AWS S3, AWS Elastic Beanstalk, Azure Web Apps
- Netlify, Vercel, Fastly, Fly.io
- Bitbucket, Surge, Ghost, Pantheon
- Zendesk, README.io, Cargo, Feedpress
Phase 3: Manual CNAME Verification
# Check CNAME records
dig +short CNAME subdomain.TARGET.com
# Verify the pointed service is unclaimed
curl -s https://subdomain.TARGET.com
# Look for: "There isn't a GitHub Pages site here"
# "No such app" (Heroku)
# "NoSuchBucket" (S3)
Phase 4: Cloud Storage Enumeration
# Check related cloud buckets
attack_script cloud_storage_enum TARGET --json-output
Phase 5: Claim & Verify
After confirming a dangling CNAME:
- Create the resource on the target service (e.g., GitHub Pages repo, S3 bucket)
- Serve a harmless proof page (e.g.,
cyberstrike-takeover-proof.html) - Verify it's accessible at
subdomain.TARGET.com
What Constitutes a Finding
| Finding | Severity |
|---|---|
| Subdomain takeover — attacker controls content | High (P2) |
| S3 bucket public write access | Critical (P1) |
| S3 bucket listing enabled | High (P2) |
| Dangling CNAME (service unreachable) | Medium (P3) |
| Cloud storage public read | Medium (P3) |
Evidence Requirements
- Subdomain with dangling CNAME record
- Target cloud service identified
- Service fingerprint (error message)
- For takeover: proof of content hosting on subdomain
- For buckets: listing output or write proof
Tools
attack_script subdomain_takeover— automated CNAME + fingerprint checkerattack_script cloud_storage_enum— S3/Azure/GCP enumerationsubfinder,puredns— subdomain enumeration