September 30, 2026

Step-by-Step Guide to Finding a Subdomain Takeover

Step 1: Find Subdomains

By Arif Hossen

1 min read

Step 1: Find Subdomains

subfinder -d target.com -silent | anew subs.txtamass enum -passive -d target.com | anew subs.txt

These commands gather subdomains from multiple sources and store them in subs.txt.

Step 2: Find CNAMEs

cat subs.txt | dnsx -cname -resp | grep -iE 'vercel|heroku|github|s3|wordpress'

This filters out any subdomains that resolve to third-party services — potential takeover candidates.

Step 3: Test for Takeover with Nuclei

nuclei -t nuclei-templates/takeovers/ -l subs.txt

Nuclei scans the subdomains against known takeover signatures. A hit here could mean the subdomain is pointing to an unclaimed service.

Step 4: Filter Real Vulnerabilities

Before jumping in, I double-check each potential takeover:

  • Visit the subdomain and see if an error message indicates the service is unclaimed (e.g., "No such app", "There isn't a site here").
  • Visit the underlying CNAME directly (e.g., dev-app.target.sh) and confirm it's dead.
  • Cross-check using can-i-take-over-xyz to avoid false positives.

Step 5: Claim the Service

In my case, I claimed dev-app.target.sh on Vercel and verified that sportsbook.target.com was now pointing to my content.

Bonus: Other Methods of Takeover

Besides CNAME-based takeovers, here are other angles to explore:

AWS S3 Buckets Look for NoSuchBucket errors — these usually indicate an unclaimed or deleted bucket. If the subdomain still points to it, you can create a bucket with the same name and take control.

GitHub Pages If a subdomain points to username.github.io, but the corresponding GitHub repository doesn't exist, you can create that repo and serve content under the victim's subdomain.

Expired Domain Takeovers When a subdomain points to a third-party domain that has expired, register the expired domain and hijack the associated subdomain.

DNS Zone Transfers (AXFR) Use dig axfr @ns1.target.com target.com. If DNS is misconfigured, you might retrieve a full list of subdomains and CNAME records.

TLS Certificate Mismatches Run testssl.sh to check if the TLS certificate was issued for a service like *.s3.amazonaws.com while the subdomain is something like files.target.com — a strong sign of misconfiguration.

Multi-hop Takeovers Follow the redirect chain. If a.target.com → b.heroku.com → c.s3.amazonaws.com and each hop is unclaimed, you can chain the takeover through all.