Agent skill · security · yaklang
subdomain-takeover
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
Why this skill is useful
Includes detailed detection methodologies and automated tools for subdomain takeover that provide actionable exploitation techniques.
What it needs
Requires dnsreaper, nuclei, subjack, subzy installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Subdomain Takeover — Detection & Exploitation Playbook AI LOAD INSTRUCTION: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the resource behind the CNAME is unclaimed and claimable. 0. RELATED ROUTING ssrf-server-side-request-forgery when a subdomain takeover is used to bypass SSRF allowlists trusting .target.com cors-cross-origin-misconfiguration when CORS trusts .target.com — takeover → full cross-origin read xss-cross-site-scripting takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse) http-host-header-attacks when Host routing leads to subdomain-scoped cache or auth issues web-cache-deception when a taken-over subdomain shares cache with the main domain --- 1. CORE CONCEPT Subdomain takeover occurs when: 1. sub.target.com has a DNS record (CNAME, NS, A) pointing to an external service 2. The external resource is no longer provisioned (deleted S3 bucket, removed Heroku app, etc.) 3. The attacker can register/claim that exact resource name on the provider 4. The attacker now controls content served under sub.target.com Impact: cookie theft (parent domain cookies), OAuth token interception, phishing under trusted domain, CORS bypass, CSP bypass via whitelisted subdomain. --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/subdomain-takeover