Question 1

What is a subdomain takeover?

Accepted Answer

A subdomain takeover occurs when a DNS record (typically a CNAME) points to an external cloud service (such as AWS S3, GitHub Pages, or Heroku) that has been deleted or unclaimed. An attacker can register the abandoned resource on the cloud provider and take complete control of the subdomain.

Question 2

How does SubdomainWatch detect dangling CNAMEs?

Accepted Answer

SubdomainWatch recursively traverses CNAME chains up to 8 hops, matches the destination against 20 verified cloud provider signatures, and conducts bounded, non-destructive HTTP slice probes to verify whether the target resource is unallocated.

Question 3

Is this takeover scan safe and non-destructive?

Accepted Answer

Yes. The scanner performs passive reconnaissance adhering to UK Computer Misuse Act 1990 and US CFAA standards. It reads only public DNS records and the first 16KB of HTTP response headers/body, without provisioning or modifying any cloud assets.

Dangling CNAME & Subdomain Takeover Scanner

Subdomain Takeover Solutions & Tools

Takeover Solutions Directory

42 Verified Cloud Signatures

vs SecurityTrails & Passive DNS

Dangling CNAME & Subdomain Takeover Scanner

Subdomain Takeover Solutions & Tools

Takeover Solutions Directory

42 Verified Cloud Signatures

vs SecurityTrails & Passive DNS