Subdomain Takeover Detection
Identifies and verifies dangling DNS records pointing to deprovisioned third-party cloud services for security assessment and remediation.
Identifies and verifies dangling DNS records pointing to deprovisioned third-party cloud services for security assessment and remediation.
Subdomain Takeover Detection provides expert guidance for uncovering and responsibly verifying dangling DNS records across cloud providers like AWS S3, GitHub Pages, Heroku, Azure, and Fastly. Designed for penetration testers and bug bounty researchers, this skill outlines a reliable methodology to inspect CNAME/A records, confirm provider-specific unclaimed fingerprints (such as 'NoSuchBucket' or GitHub 404 pages), execute benign proof-of-concept claims, and assess high-severity chained risks like OAuth redirect hijacking, cookie scoping, and CSP bypasses.