Subdomain Takeover

This walks through finding and exploiting dangling DNS records that point to deprovisioned cloud resources. You get fingerprint tables for spotting vulnerable CNAMEs (S3 buckets, Heroku apps, GitHub Pages), step-by-step claim procedures for each provider, and coverage of the nastier variants like NS takeover where you control an entire zone. The decision tree and tooling recommendations (subjack, nuclei, dnsreaper) are solid. Worth noting it correctly emphasizes that a CNAME existing doesn't mean takeover is possible, only when the target resource is actually unclaimed and you can register it. Routing to related skills like SSRF and CORS bypass shows where subdomain control becomes a pivot point for deeper exploitation.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill subdomain-takeover --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Subdomain Takeover — Detection & Exploitation Playbook

AI LOAD INSTRUCTION: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the resource behind the CNAME is unclaimed and claimable.

0. RELATED ROUTING

ssrf-server-side-request-forgery when a subdomain takeover is used to bypass SSRF allowlists trusting *.target.com
cors-cross-origin-misconfiguration when CORS trusts *.target.com — takeover → full cross-origin read
xss-cross-site-scripting takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse)
http-host-header-attacks when Host routing leads to subdomain-scoped cache or auth issues
web-cache-deception when a taken-over subdomain shares cache with the main domain