Step-by-Step Subdomain Takeover Process

This guide details how to identify and exploit subdomain takeover vulnerabilities, a common bug bounty target. The process is divided into three main steps.

Step 1: Reconnaissance

Begin by collecting subdomains using tools like subfinder and amass. The output is then filtered to identify potential errors, focusing on common cloud providers.

• Look for NoSuchBucket errors (AWS S3).
• Check for 404 There isn't a GitHub Pages site here errors (GitHub Pages).
• Identify No such app errors (Heroku).

The dnsx tool helps filter results based on potential vulnerabilities.

Step 2: Verification and Filtering

Not all errors indicate exploitable vulnerabilities. It's crucial to filter out false positives.

• Check for Dangling CNAMEs: Verify if a CNAME points to a non-existent service (e.g., Heroku app).
• Avoid False Positives: Use the can-i-take-over-xyz tool to determine if a service is truly claimable (avoiding services like Shopify that return 404 but aren't vulnerable).

Step 3: Claiming the Subdomain (AWS S3 Example)

The article uses an AWS S3 example to illustrate the claiming process.

• Find an interesting CNAME: Identify a subdomain pointing to an AWS S3 bucket.
• Check bucket existence: Use the aws s3 ls command. A NoSuchBucket error confirms the vulnerability.
• Create and populate the bucket: Create the bucket and upload a proof-of-concept to claim the subdomain.