What this skill does

Detects and verifies subdomain takeover vulnerabilities by identifying dangling DNS CNAME records that point to unclaimed or deprovisioned third-party services. For each CNAME, resolves the target, checks the HTTP response against known vulnerable-service fingerprints, and confirms exploitability by verifying the resource can be claimed. Covers 18+ vulnerable services including GitHub Pages, AWS S3, Heroku, Netlify, Azure (Traffic Manager, Blob, CloudApp), Shopify, Fastly, Ghost, Pantheon, Tumblr, WordPress.com, Cargo Collective, Surge.sh, Bitbucket, Zendesk, Readme.io, and Statuspage.

When to use

During recon on a bug bounty program to find high-impact, low-effort findings
After subdomain enumeration (e.g. from the subdomain-enum skill) to check each live CNAME
When auditing an organization's DNS records for hygiene and dangling entries
After a product decommissioning or cloud migration to verify DNS cleanup was complete

subdomain-takeover

What this skill does

When to use

Prerequisites