f

Author: carlospolop

src/pentesting-web/domain-subdomain-takeover.md

@@ -26,14 +26,16 @@ There are several tools with dictionaries to check for possible takeovers:
 - [https://github.com/PentestPad/subzy](https://github.com/PentestPad/subzy)
 - [https://github.com/Stratus-Security/Subdominator](https://github.com/Stratus-Security/Subdominator)
 - [https://github.com/NImaism/takeit](https://github.com/NImaism/takeit)
+- [https://github.com/projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei) (use `-tags takeover` with nuclei-templates)
+- [https://github.com/edoardottt/cariddi](https://github.com/edoardottt/cariddi) (takeover checks in crawling output)
 
 ### Subdomain Takeover Generation via DNS Wildcard
 
 When DNS wildcard is used in a domain, any requested subdomain of that domain that doesn't have a different address explicitly will be **resolved to the same information**. This could be an A ip address, a CNAME...
 
 For example, if `*.testing.com` is wildcarded to `1.1.1.1`. Then, `not-existent.testing.com` will be pointing to `1.1.1.1`.
 
-However, if instead of pointing to an IP address, the sysadmin points it to a **third party service via CNAME**, like a G**ithub subdomain** for example (`sohomdatta1.github.io`). An attacker could **create his own third party page** (in Gihub in this case) and say that `something.testing.com` is pointing there. Because, the **CNAME wildcard** will agree the attacker will be able to **generate arbitrary subdomains for the domain of the victim pointing to his pages**.
+However, if instead of pointing to an IP address, the sysadmin points it to a **third party service via CNAME**, like a **GitHub subdomain** for example (`sohomdatta1.github.io`). An attacker could **create his own third party page** (in GitHub in this case) and say that `something.testing.com` is pointing there. Because the **CNAME wildcard** will agree, the attacker will be able to **generate arbitrary subdomains for the domain of the victim pointing to his pages**.
 
 You can find an example of this vulnerability in the CTF write-up: [https://ctf.zeyu2001.com/2022/nitectf-2022/undocumented-js-api](https://ctf.zeyu2001.com/2022/nitectf-2022/undocumented-js-api)
 
@@ -65,7 +67,7 @@ It might be possible that the compromised subdomain is allowed to be used in the
 
 ### CSP Bypass
 
-It might be possible that the compromised subdomain (or eveyr subdomain) is allowed to be used for example the `script-src` of the CSP. This could be exploited by an attacker to **inject malicious scripts** and abuse potential XSS vulnerabilities.
+It might be possible that the compromised subdomain (or every subdomain) is allowed to be used for example the `script-src` of the CSP. This could be exploited by an attacker to **inject malicious scripts** and abuse potential XSS vulnerabilities.
 
 ### **Emails and Subdomain Takeover**
 
@@ -89,6 +91,25 @@ Mitigation strategies include:
 
 For cloud providers, verifying domain ownership is crucial to prevent subdomain takeovers. Some, like [GitLab](https://about.gitlab.com/2018/02/05/gitlab-pages-custom-domain-validation/), have recognized this issue and implemented domain verification mechanisms.
 
+## Detection techniques
+
+- **Find dangling DNS records**: look for CNAME/A/AAAA/ALIAS/ANAME records pointing to non-existent resources (deleted buckets, apps, pages, load balancers).
+- **Check provider error signatures**: match HTTP responses, TLS certs, or DNS errors to known takeover patterns (see can-i-take-over-xyz).
+- **Look for orphaned cloud assets**: verify S3/CloudFront, Azure Websites, GCP App Engine/Storage, GitHub Pages, Heroku, Fastly, Netlify, Vercel, Zendesk, Shopify, Atlassian, and similar services.
+- **Passive DNS and historical records**: old CNAMEs often reveal previously used third-party services that may still be vulnerable.
+- **Wildcard pitfalls**: confirm wildcard DNS vs. explicit records to avoid false positives and understand takeover amplification.
+
+## APIs and data sources
+
+- [https://securitytrails.com/](https://securitytrails.com/) (historical DNS, passive DNS API)
+- [https://community.riskiq.com/](https://community.riskiq.com/) (PassiveTotal)
+- [https://www.farsightsecurity.com/solutions/dnsdb/](https://www.farsightsecurity.com/solutions/dnsdb/)
+- [https://www.domaintools.com/products/iris/](https://www.domaintools.com/products/iris/)
+- [https://search.censys.io/](https://search.censys.io/) (certs and host data)
+- [https://www.shodan.io/](https://www.shodan.io/) (host data)
+- [https://www.virustotal.com/](https://www.virustotal.com/) (historical DNS, URLs)
+- [https://chaos.projectdiscovery.io/](https://chaos.projectdiscovery.io/) (subdomains dataset)
+
 ## References
 
 - [https://0xpatrik.com/subdomain-takeover/](https://0xpatrik.com/subdomain-takeover/)
@@ -98,4 +119,3 @@ For cloud providers, verifying domain ownership is crucial to prevent subdomain
 {{#include ../banners/hacktricks-training.md}}
 
 
-