Stats
Actions
Tags
From claude-bughunter
Hunts subdomain takeover vulnerabilities using DNS CNAME analysis, HTTP error fingerprints, and modern provider-specific checks (Azure, Zendesk, Vercel, Fastly, S3). Emphasizes account-takeover chain primitives for report writing.
How this skill is triggered — by the user, by Claude, or both
Slash command
/claude-bughunter:hunt-subdomainThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Subdomain takeover is high-value because it allows an attacker to serve content from a **trusted, company-owned domain** — bypassing browser same-origin trust, phishing filters, and user skepticism simultaneously.
Subdomain takeover is high-value because it allows an attacker to serve content from a trusted, company-owned domain — bypassing browser same-origin trust, phishing filters, and user skepticism simultaneously.
Highest payout contexts:
new., preview., course., delivery., addons-preview.) — abandoned after feature launchesAsset types that matter most:
DNS signals:
CNAME pointing to *.github.io, *.gitlab.io, *.fastly.net, *.herokudns.com, *.wordpress.com, *.uservoice.com, *.zendesk.com, *.s3.amazonaws.com, *.azurewebsites.net, *.netlify.appSERVFAIL on the CNAME target while the parent record still existsHTTP response signals:
"There isn't a GitHub Pages site here""NoSuchBucket" (S3)"The specified bucket does not exist""No such app" (Heroku)"Sorry, this shop is currently unavailable" (Shopify)"This UserVoice subdomain is available""Do you want to register" (any domain parking page)"Fastly error: unknown domain""404 Web Site not found" (Azure App Service)Tech stack signals:
X-Served-By: cache-* (Fastly), X-GitHub-Request-Id, Server: NetlifyCNAME chain resolving to provider infrastructure but returning provider 404*.fastly.net) rather than company domainEnumerate all subdomains for the target using passive + active sources:
subfinder -d target.com -allamass enum -passive -d target.comassetfinder --subs-only target.comcrt.sh/?q=%.target.comResolve all subdomains and flag those with:
cat subdomains.txt | dnsx -a -cname -o resolved.txt
Cross-reference CNAMEs against known vulnerable provider fingerprints using nuclei or subjack:
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -c fingerprints.json
nuclei -l subdomains.txt -t takeovers/
Manual verification for each flagged subdomain:
dig CNAME subdomain.target.com — confirm CNAME existsdig A <cname-target> — confirm NXDOMAIN or no resolutioncurl -sk https://subdomain.target.com — check for provider error stringConfirm claimability — attempt to register the resource:
<username>.github.io/<repo> or org page is unclaimedaws s3api create-bucket --bucket <bucketname>Claim the resource (only enough to prove control — do NOT serve malicious content):
subdomain.target.comDocument the chain: CNAME record → provider target → unclaimed resource → your content
Assess impact escalation:
domain=.target.com)?Write report before releasing the claim (some programs want to verify first)
Bulk CNAME extraction and NXDOMAIN detection:
# Extract CNAMEs and check if target resolves
while read sub; do
cname=$(dig +short CNAME "$sub" | head -1)
if [ -n "$cname" ]; then
result=$(dig +short A "$cname")
if [ -z "$result" ]; then
echo "[POTENTIAL] $sub -> $cname (NXDOMAIN)"
fi
fi
done < subdomains.txt
Nuclei takeover scan:
nuclei -l subdomains.txt -t ~/nuclei-templates/http/takeovers/ -severity medium,high,critical
subjack with SSL:
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -c $GOPATH/src/github.com/haccer/subjack/fingerprints.json -v
Provider fingerprint grep patterns:
curl -sk "https://$subdomain" | grep -iE \
"there isn't a github pages|no such bucket|no such app|this uservoice|fastly error: unknown domain|do you want to register|sorry, this shop|project not found|404 not found|unclaimed"
Check if subdomain is in scope for cookies (shared parent domain):
curl -Isk "https://target.com" | grep -i "set-cookie" | grep "domain=.target.com"
Fastly-specific detection:
curl -sI "https://subdomain.target.com" -H "Host: subdomain.target.com" | grep -i "fastly\|x-served-by\|x-cache"
curl -sk "https://subdomain.target.com" | grep -i "fastly error"
S3 unclaimed bucket check:
aws s3api head-bucket --bucket <extracted-bucket-name> 2>&1 | grep -i "NoSuchBucket\|403\|404"
GitLab Pages specific:
dig CNAME sub.target.com
# If pointing to *.gitlab.io — visit the gitlab.io URL directly
# 404 from gitlab.io project = claimable
Service offboarding without DNS cleanup — Developer removes a Heroku app, UserVoice account, or WordPress site but never deletes the CNAME record. DNS lives forever; service does not.
Staging/preview infrastructure abandoned post-launch — course., new., preview., beta. subdomains provisioned for a product launch, pointed at a third-party, then forgotten when the campaign ends.
Subdomain provisioned by a third-party team — Marketing sets up a UserVoice or Zendesk subdomain via IT, product sunset kills it, but DNS is owned by engineering who doesn't know.
CDN misconfiguration without origin validation — Fastly and similar CDNs historically allowed any domain to "claim" a backend hostname by creating a service pointing to it. Unregistered origin hostnames become claimable.
GitHub/GitLab Pages namespace not reserved — Organization renames, user accounts deleted, or repos made private/deleted while the Pages CNAME still points to the old namespace.
Wildcard DNS entries — *.target.com pointing to a cloud provider means any unclaimed subdomain potentially resolves to claimable infrastructure.
Acquired/divested company DNS not cleaned — Post-acquisition, former brand subdomains (like oberlo.com under Shopify) retain CNAMEs to services that are no longer paid for.
Defense: Manual fingerprint review before publishing
Defense: Scope restrictions (only main domain in scope)
*.target.com wildcards often include subdomains implicitly. Escalate impact to get it in scope.Defense: "Can't reproduce" responses due to timing
Defense: HTTPS certificate mismatch blocking proof
Defense: Provider-side validation (Fastly verifying domain ownership)
Defense: Rate limiting on subdomain enumeration
Defense: Program claims "low severity / no impact"
postMessage targetOrigin checks in JS.What can the attacker DO right now? Can you register the unclaimed resource (GitHub repo, S3 bucket, Heroku app, UserVoice account) and serve arbitrary content — including phishing pages, credential harvesters, or malicious scripts — under the target's trusted domain name?
What does the victim LOSE?
Users lose trust and safety: they see a company-branded URL serving attacker content. The company loses brand integrity, potentially leaks session cookies if the subdomain is in domain=.target.com scope, and may have OAuth/SSO flows hijacked. Depending on CSP configuration, XSS against the main application may be possible.
Can it be reproduced in 10 minutes from scratch?
dig CNAME subdomain.target.com → confirms CNAME to providercurl -sk https://subdomain.target.com → confirms provider error stringIf you cannot show the provider resource is currently unclaimed and claimable, it is not a valid report.
Scenario A — Trusted Brand Phishing via Abandoned SaaS (Snapchat/UserVoice)
An attacker finds feedback.snapchat.com CNAME pointing to a UserVoice subdomain. The UserVoice account was cancelled but the DNS record remained. The attacker registers the matching UserVoice subdomain for free, gaining control of feedback.snapchat.com. Any user navigating to that URL — perhaps from old bookmarks or Google results — sees attacker-controlled content on a Snapchat-branded domain. Since the domain is trusted by browsers, phishing campaigns sent from this subdomain bypass email security filters that check domain reputation.
Scenario B — CDN Origin Takeover Enabling Same-Origin Attacks (Mozilla/Fastly)
addons-preview-cdn.mozilla.net had a CNAME pointing to a Fastly origin hostname that was no longer registered to Mozilla's Fastly account. An attacker could create a Fastly service claiming that origin hostname, causing all requests to addons-preview-cdn.mozilla.net to be routed to attacker-controlled Fastly infrastructure. Since the subdomain shares the mozilla.net domain, it could be leveraged to serve malicious CDN assets that appear to come from Mozilla's infrastructure, potentially bypassing CSP rules that allowlist *.mozilla.net.
Scenario C — Staging Subdomain Abandoned Post-Product Migration (Rails/GitHub Pages)
new.rubyonrails.org was pointed at a GitHub Pages deployment for a website redesign project. After the new site launched and the old GitHub repo was deleted or made private, the DNS CNAME remained. An attacker could fork or create a matching GitHub Pages repository and claim the namespace, serving content under new.rubyonrails.org. Because this is the official Ruby on Rails domain, any content served there — including fake download links or malicious gems — carries the full trust of the Rails brand.
The following coordinated-disclosure / writeup cases extend this skill with modern provider fingerprints (Vercel/Azure cloudapp/Zendesk era) and explicit ATO-chain examples. Citations #12 and #13 are external writeups (not disclosed HackerOne reports) — treat their payout figures as unverified; only #14 has a public H1 report ID.
Microsoft Azure DevOps — Two cloudapp.azure.com subdomains + wildcard *.visualstudio.com OAuth reply_to → 1-click ATO (Binary Security writeup)
cloudapp.azure.com regional-pool dangling CNAME — chained to ATOapp.vssps.visualstudio.com/_signin?reply_to=https://feedsprodwcus0dr.feeds.visualstudio.com/ whitelisted any *.visualstudio.com. Attacker claimed the dangling Azure VM hostnames, then crafted sign-in URLs that returned JWT + FedAuth tokens to attacker-controlled endpointscloudapp.azure.com CNAME, deploy a free-tier VM in the same Azure region requesting the exact released hostname, Azure re-issues the name first-come-first-serveAnonymous H1 — admin-support.xyz.com → unclaimed Zendesk → email interception → ATO (Writeup by 0xprial)
xyzdocs.zendesk.com host-mapping[email protected] tickets containing payment info + password-reset emails, then triggered password resets on customer accounts that delivered reset links into the attacker's Zendesk inboxdig CNAME returns xyzdocs.zendesk.com (unregistered) → register free Zendesk trial → add xyzdocs as subdomain → enable host-mapping for admin-support.xyz.comVercel deleted-project takeover — a dangling cname.vercel-dns.com CNAME pointing to a removed Vercel project can be re-claimed by deploying a new project under that name.
cname.vercel-dns.com) after project deletionproxies. subdomain trusted for RPC proxy routing; attacker could serve malicious wallet-drain JS under a "trusted" subdomainDEPLOYMENT_NOT_FOUND → create free Vercel project → Settings → Domains → add proxies.sifchain.finance — Vercel verifies the existing CNAME and auto-issues TLS without out-of-band ownership proofFastly CDN dangling-service technique (general, not a single disclosed report):
Fastly error: unknown domain. Please check that this domain has been added to a serviceassets./CDN host for script-srcSubdomain takeover by itself is Low-Medium / Informational on most mature programs — defacement of a non-business-critical subdomain is unsexy. The chain payout is 10-100x the standalone. Every takeover should be evaluated against the five chains below before submission. If none apply, you have a Low; if one applies, you have a High; if two compose, you have a Critical.
redirect_uri Whitelist → Auth-Code Theft → 1-Click ATOredirect_uri allowlist via /oauth/authorize flow. Look for any wildcard *.target.com or any takeover-candidate hostname in the static list (e.g., feedsprod.feeds.visualstudio.com, legacy.target.com)./oauth/authorize?redirect_uri=https://legacy.target.com/cb&response_type=code&client_id=<legit>. Victim's browser already has session → auth happens transparently → auth code lands on attacker host. Exchange via token endpoint → ATO.cloudapp.azure.com + wildcard *.visualstudio.com reply_to chain (Binary Security, Nov 2022 — Disclosed Report Citation #12). Multiple H1 disclosures on SaaS programs with permissive OAuth allowlists.app.target.com). If Set-Cookie has Domain=.target.com (parent-scoped) instead of host-only, cookies bleed to every sibling subdomain — including taken-over ones.legacy.target.com, feedback.target.com, assets.target.com). The taken-over host can now Set-Cookie for the parent domain.Set-Cookie: SESSIONID=<attacker_session>; Domain=.target.com via a script on the taken-over host. Victim visits app.target.com with attacker's session cookie attached. Server treats them as the attacker's account → session-fixation ATO.__Host- prefixed session cookie.hunt-auth-bypass Duende BFF Attack Class 2 (cookie-domain wildcarding turns subdomain takeover into session fixation). Pattern class: S3-bucket-takeover combined with parent-scoped (Domain=.target.com) cookies.script-src Includes the Taken-Over Host → Persistent Stored XSS on Main Appscript-src 'self' assets.target.com cdn.target.com legacy.target.com ....<script src="//taken-over-host/x.js"> because the host is on the CSP allowlist. JS executes with main-app origin — full session access, can call any same-origin API.proxies.sifchain.finance Vercel takeover — Disclosed Report Citation #14 (web3 phishing); pattern documented in multiple H1 disclosures 2020-2024.Access-Control-Allow-Origin Regex Match → Credentialed Cross-Origin API ReadAccess-Control-Allow-Origin that includes *.target.com or target.com.* (the second is a common bug).target.com.attacker.com host if suffix-match is broken).fetch('https://api.target.com/account', {credentials:'include'}). CORS preflight passes. Server returns credentialed response. Attacker's JS reads it.hunt-api-misconfig CORS subsection. Pairs with hunt-misc step 1 (CORS regex enumeration).selector1._domainkey.target.com), SPF includes (include:_spf.takeover-candidate.com), MX records (mx.target.com → defunct-provider.example).@target.com.From: [email protected] to victim. Recipient mail server passes SPF + DKIM checks (because the takeover server is now authorised). Email lands in inbox with target.com brand, no security warning.offensive-osint.The five chains above are exhaustive in practice — virtually every senior-tier subdomain-takeover payout maps to one of them. Before reporting any takeover, run through the checklist:
redirect_uri allowlist — does the taken-over host appear? → Chain 1, Critical.Domain=.target.com? → Chain 2, High.script-src — does the taken-over host appear in the allowlist? → Chain 3, Critical.If none apply, file at Low/Informational. Do not file at Critical without demonstrating one of these chains — triagers downgrade fast otherwise.
Cross-references:
hunt-oauth — Chain 1 (redirect_uri bypass class)hunt-auth-bypass Duende BFF Attack Class 2 — Chain 2 (cookie scoping)hunt-xss Chain 4 — Chain 3 (CSP bypass via trusted-origin JS)hunt-api-misconfig CORS section — Chain 4offensive-osint email-security section — Chain 5hunt-cloud-misconfig — Most stale CNAMEs point at deleted cloud assets (S3, CloudFront, Heroku). Chain primitive: Cloud misconfig (S3 deleted) + hunt-subdomain → unclaimed CNAME points to bucket → claim bucket name → full subdomain control.hunt-oauth — A takeover on an OAuth redirect_uri host = persistent ATO across the entire SSO surface. Chain primitive: Subdomain takeover at auth.target.com + OAuth redirect_uri allowlist → auth code theft → ATO every user that re-authenticates.hunt-api-misconfig — CORS regexes routinely allowlist a takeoverable subdomain. Chain primitive: Subdomain takeover + CORS *.target.com with credentials → credentialed cross-origin API read → mass IDOR.hunt-xss — A claimed subdomain is same-origin to session-cookie-domain siblings. Chain primitive: Subdomain takeover at feedback.target.com + cookie scope .target.com → JS hosted on takeover host reads main-app cookies → session hijack.security-arsenal — Load the 27+ Subdomain Takeover Fingerprint Table (NoSuchBucket, "no such app", GitHub Pages 404 strings, Heroku, Shopify, Fastly) and the subzy/subjack automation patterns.triage-validation — Apply the Unique-Marker gate: takeover claim is informational on its own; submit only after publishing a unique HTML marker on the claimed host AND demonstrating a downstream impact (cookie read, OAuth chain, CSP bypass).npx claudepluginhub elementalsouls/claude-bughunterDiscovers and exploits broken link hijacking vulnerabilities by identifying expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.
Discovers and exploits broken link hijacking vulnerabilities by identifying expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.
Hunts for miscellaneous vulnerabilities (access control, info disclosure, auth logic, misconfiguration) using patterns from 225 bug bounty reports. Maps role boundaries, probes internal APIs, and checks for privilege escalation surfaces.