Subdomain Takeover

A free critical if found within minutes of the misconfig.

When to invoke

Trigger phrases:

• "subdomain takeover"
• "dangling DNS"
• "can I take over X"
• "abandoned subdomain"

Pre-flight: is it in scope?

Many programs exclude subdomain takeovers due to abuse. Always check.

• If excluded → still document but don't submit
• If allowed → high-value finding

The vulnerability