TL;DR
Subdomain takeover happens when a CNAME in your DNS points to an external service (GitHub Pages, Heroku, S3) that you don't control anymore. Someone else can claim it. Now they're serving their own content from your subdomain. Audit your DNS records and clear out anything still pointing at a service you shut down.
How Subdomain Takeover Works
# Your DNS has this old record:
blog.yoursite.com CNAME yoursite.github.io
# But you deleted the GitHub Pages repo!
# Attacker creates a new repo named "yoursite"
# GitHub assigns yoursite.github.io to them
# Now blog.yoursite.com serves attacker's content
Vulnerable Services
Services commonly vulnerable to subdomain takeover include:
- GitHub Pages: Unclaimed github.io subdomains
- Heroku: Deleted apps with lingering CNAMEs
- AWS S3: Deleted buckets referenced by DNS
- Azure: Deprovisioned cloud services
- Shopify, Fastly, Netlify: Various edge cases
Impact: Attackers can steal cookies (if SameSite is Lax), host phishing pages, or serve malware from your trusted domain. They can even issue valid SSL certificates for your subdomain, since certificate authorities trust whoever controls the DNS.
How to Prevent It
- Audit DNS regularly: Check all CNAME records point to active services
- Remove before deprovisioning: Delete DNS records before shutting down external services
- Monitor for issues: Tools like nuclei and subjack can detect vulnerable subdomains
- Use wildcards carefully: Wildcard CNAMEs increase risk
How do I find vulnerable subdomains?
Enumerate subdomains with subfinder or amass, then check each CNAME by hand. Look for the tell: an error page saying something like "There isn't a GitHub Pages site here."
Can attackers get SSL certificates?
Yes. Most certificate authorities validate over HTTP, so whoever controls the content on that subdomain can request a cert for it, attacker included.
Scan for Subdomain Takeover
Our scanner checks your DNS for vulnerable subdomain configurations.