Subdomain Takeover
HighSubdomain Takeover
Definition
Subdomain Takeover happens when a subdomain points (via CNAME or A record) to an external service that is no longer in use or has not been claimed. An attacker can register that external service and take control of the subdomain, serving malicious content, stealing cookies from the parent domain or running convincing phishing.
Impact
Sophisticated phishing from a legitimate subdomain of the organizationCookie theft from the parent domain (if the Domain attribute is not used correctly)Malware distribution from a seemingly trusted URLReputational damage to the organizationCSP policy bypass if the subdomain is allowlisted
Examples
Subdomain Takeover on GitHub Pages
The subdomain blog.victim.com has a CNAME pointing to victim.github.io, but the organization/repo on GitHub does not exist. The attacker creates the repository and configures GitHub Pages to serve content under the victim's subdomain.
# 1. Find a subdomain with a CNAME to GitHub Pages $ dig blog.victim.com CNAME blog.victim.com. CNAME victim.github.io. # 2. Verify that the repository/organization does not exist $ curl https://blog.victim.com # Response: "There isn't a GitHub Pages site here." # 3. Create the repository victim.github.io in your GitHub account # 4. Add a CNAME file with "blog.victim.com" # 5. Now you control blog.victim.com