Subdomain Takeover


  1. Domain name ( uses a CNAME record for another domain ( CNAME

  2. At some point, expires and is available for anyone's registration.

  3. Since the CNAME record is not removed from the DNS zone of, anyone who records has full control over until the DNS record is present.



subzy -targets list.txt
subzy -concurrency 100 -hide_fails -targets subs.txt
subjack -w /root/subdomain.txt -a -v -t 100 -timeout 30 -o results.txt -ssl # Subdomains generated with subgen
# -u