Pentest Book
Subdomain Takeover


  1. 1.
    Domain name ( uses a CNAME record for another domain ( CNAME
  2. 2.
    At some point, expires and is available for anyone's registration.
  3. 3.
    Since the CNAME record is not removed from the DNS zone of, anyone who records has full control over until the DNS record is present.


Subdomain Takeover: Proof Creation for Bug Bounties
Patrik Hudak
GitHub - EdOverflow/can-i-take-over-xyz: "Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.
Export as PDF
Copy link
Edit on GitHub