🏴‍☠️

Subdomain Takeover Scanner

Detect "dangling" DNS records that point to discontinued third-party cloud services vulnerable to hostile claim.

VECTORS: S3, Heroku, GitHub Pages
RISK: Critical (CVSS 8.5+)
IDENTIFIED BY: CNAME / 404 Status

What is Subdomain Takeover Scanner?

A critical vulnerability scanner that finds subdomains pointing (via CNAME) to third-party services that the company no longer pays for or controls, allowing an attacker to register that service and hijack the subdomain.

How it Works

The tool evaluates the DNS CNAME records of a given host. It checks the target provider (e.g., AWS S3, Azure, GitHub). If the provider responds with a specific "Bucket not found" or "Unclaimed site" error, it flags the domain as highly vulnerable.

Key Use Cases

Securing enterprise DNS zones against severe reputation hijacking.

Automated bug bounty hunting.

Ensuring offboarded SaaS apps do not leave dangerous artifacts in the master routing tables.

Advanced Details

If an attacker successfully claims a dangling subdomain linked to your primary domain, they can bypass Same-Origin Policy (SOP), steal session cookies, host phishing pages that look 100% legitimate, and compromise the overarching brand.

Cybersecurity Pros & Cons

Security Advantages
  • Subdomain takeover is a CVSS 8.5+ critical vulnerability — automated detection enables rapid remediation before exploitation.
  • Discovering dangling CNAME records is non-destructive — the vulnerability is confirmed without any impact on the target.
  • Takeover vectors cover the most popular cloud platforms (AWS S3, Azure, Heroku, GitHub Pages) where orphaned resources are common.
  • Regular scanning detects new takeover vulnerabilities created every time a cloud service is decommissioned without DNS cleanup.
Security Limitations
  • Subdomain takeover scanning requires actively requesting the third-party cloud service endpoint — potentially triggering rate limits.
  • False positives occur when providers return "404 Bucket not found" for secured private buckets as well as unclaimed ones.
  • Detection signatures need constant updates as cloud providers change their specific "unclaimed resource" error messages.
  • A successfully identified takeover still requires immediate DNS record removal — the fix is in DNS management, not the scanner.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs