Subdomain Takeover labs
Subdomain Takeover
What is Subdomain Takeover?
Subdomain Takeover happens when a subdomain points (via CNAME) to an external service that no longer exists or is unclaimed. The attacker registers that resource and serves content under the legitimate subdomain, enabling phishing, cookie theft and CORS/OAuth bypass.
Why practice Subdomain Takeover?
Large companies accumulate hundreds of subdomains pointing to cloud services that were decommissioned one day without cleaning up DNS. Claiming them is relatively mechanical but high impact: a taken subdomain breaks the cookie, CORS and OAuth trust of the whole parent domain. Typical bounties: $500-$5,000.
What will you learn with the Subdomain Takeover labs?
You'll learn to enumerate subdomains at scale, detect dangling CNAMEs, fingerprint the footprint of an unclaimed service (S3's NoSuchBucket, GitHub Pages' 404), claim the resource safely and prove impact without causing harm.
Types of Subdomain Takeover we cover
- Dangling S3 bucket
CNAME to an S3 bucket that no longer exists. You create a bucket with the same name and serve your content.
- GitHub/GitLab Pages
Subdomain pointing to a deleted Pages repo. You claim the name in your account and publish your site.
- Unclaimed PaaS
CNAME to Heroku, Azure, Fastly, Shopify... with the app deleted. You register the same identifier at the provider.
- NS takeover
Rare and serious case: the NS delegation points to a zone at a provider where you can recreate it, controlling the whole subdomain.
How do you find and exploit Subdomain Takeover?
A practical playbook — from recon to proof of concept.
- 1
Enumerate subdomains
Collect as many of the target's subdomains as possible with passive sources and brute force. The more you have, the higher the chance of finding a dangling one.
subfinder -d target.com -all | tee subs.txt - 2
Resolve and look for CNAMEs
Resolve each subdomain and keep the ones with a CNAME toward a third-party service. Those are the candidates.
dig CNAME app.target.com +short → target.s3.amazonaws.com - 3
Detect the dead-service footprint
Visit the subdomain and look for the provider's characteristic error message indicating an unclaimed resource.
curl -s https://app.target.com → "NoSuchBucket" (S3) / "There isn't a GitHub Pages site here" - 4
Confirm with tools
Validate the finding with a scanner that knows each service's signatures to avoid false positives.
subzy run --targets subs.txt · nuclei -t takeovers -l subs.txt - 5
Claim the resource (clean PoC)
Register the resource (bucket/repo/app) with the same identifier and serve a harmless page with your bug bounty handle.
Create S3 bucket 'target' and upload poc.html with your HackerOne handle
Learn the theory
Academy: Recon & Info Disclosure
Loading labs...
View in full catalog →Frequently asked questions
What is a Subdomain Takeover?
It's when an organization's subdomain points (usually via CNAME) to an external service that no longer exists or is unclaimed. An attacker registers that resource and starts serving content under the victim's legitimate subdomain.
How is a Subdomain Takeover exploited?
You detect a dangling CNAME toward a service (S3, GitHub Pages, Heroku) that shows an 'unclaimed resource' footprint, and register that same resource at the provider with the expected identifier. From there you control the subdomain's content.
How do you find Subdomain Takeover in bug bounty?
Enumerate subdomains with subfinder/amass, resolve their CNAMEs and look for ones pointing at third-party services. Identify the characteristic unclaimed-resource error pages and confirm with subzy or nuclei before claiming it in a controlled way.
How do you prevent a Subdomain Takeover?
Keep a DNS inventory, remove CNAME/ALIAS records as soon as you decommission a cloud service, automate monitoring of dangling subdomains, and avoid delegations to resources you could lose without updating DNS.
Why is a Subdomain Takeover serious if it's just a subdomain?
Because it inherits the parent domain's trust: it enables credible phishing, stealing domain cookies (.target.com), passing subdomain-based CORS allowlists and abusing OAuth redirect_uri with a subdomain wildcard, escalating the impact to the main app.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Subdomain Takeover in real labs
Every Subdomain Takeover lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime