> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/dns/subdomain-takeover.md).

# Subdomain Takeover

Subdomain takeover occurs when a subdomain is pointing to an external service (e.g., GitHub Pages, AWS S3, Heroku) but the resource is no longer active. An attacker can claim the abandoned resource and gain control over the subdomain.

***

### **Identify and Exploit Subdomain Takeover**

#### **Find CNAME Records**

CNAME records indicate if a subdomain is pointing to an external service.

```bash
dig CNAME sub.example.com
```

```
host -t CNAME sub.example.com
```

```
dnsx -l live_subdomains.txt -a -resp-only -o cname_records.txt
```

* If the CNAME points to an external service but does not resolve properly, it could be vulnerable to takeover.

***

#### **Check for Vulnerabilities**

* If the subdomain is pointing to an abandoned service, the attacker can register the service and take control of the subdomain.
* Examples:
  * GitHub Pages (`*.github.io`)
  * AWS S3 (`s3.amazonaws.com`)
  * Heroku (`*.herokudns.com`)
  * Shopify (`shops.myshopify.com`)
  * Cloudfront (`*.cloudfront.net`)
* Vulnerable Services  ([GitHub list](https://github.com/EdOverflow/can-i-take-over-xyz))

***

#### **Exploitation**

* If a subdomain is vulnerable:
  1. Register the abandoned service (e.g., claim the repository on GitHub Pages).
  2. Upload a malicious webpage or phishing content.
  3. Gain control over any authentication flows linked to the subdomain.