Recon & OSINT

Subdomain Takeover

Claim domains that companies forgot to clean up. Dangling CNAME records pointing to deprovisioned cloud services are everywhere — and they hand you a company subdomain on a plate.

Intermediate40 min6 lessons1 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Explain what a dangling CNAME is and why it enables subdomain takeover
✓Enumerate subdomains passively and actively using subfinder, dnsx, and httpx
✓Fingerprint unclaimed external services by their error responses
✓Demonstrate a responsible PoC takeover and document it for a bug report
✓Implement DNS hygiene practices to prevent takeovers in production

Lessons

1What Is a Subdomain Takeover?
2Finding Dangling CNAMEs
3Your Turn: Claim the Dangling RecordHANDS-ON
4Exploitation — Claiming the Endpoint
5Defence & Remediation
6Final Assessment — Subdomain Takeover

Start free →