New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Subdomain Takeover

by yaklang in yaklang/hack-skills

Subdomain takeover detection and exploitation playbook. An agent skill from yaklang/hack-skills.

MITAuto-check passedSecurity

Install Subdomain Takeover

skills CLI
$ npx skills add yaklang/hack-skills --skill subdomain-takeover -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install yaklang/hack-skills subdomain-takeover --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/subdomain-takeover .claude/skills/subdomain-takeover && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
subdomain-takeover
GitHub stars
2.4k
Token cost
~2.6k tokens
SKILL.md length
814 words
Files
1
Skills in repo
27
Repo updated
First seen
Licence
MIT

At a glance

Subdomain takeover detection and exploitation playbook. An agent skill from yaklang/hack-skills.

  • Works in 11 steps: RELATED ROUTING → CORE CONCEPT → DETECTION METHODOLOGY → …
  • Targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources
  • SKILL.md covers 0. RELATED ROUTING, 1. CORE CONCEPT, 2. DETECTION METHODOLOGY and 3. SERVICE PROVIDER…, plus 7 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Subdomain Takeover is an agent skill from yaklang/hack-skills. Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.

Its SKILL.md is about 2.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Penetration testing. It works with GitHub and Amazon S3. The repository describes itself as: Helping AI Agent become an awesome practical hacker! The licence is MIT.

When your agent uses it

  • Targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources
  • Expired third-party services
  • Unclaimed SaaS tenants that an attacker can register to serve content under the victims domain

Example prompts

  • “/subdomain-takeover”

Workflow steps

11 steps, taken from the step headings in SKILL.md.

  1. RELATED ROUTING
  2. CORE CONCEPT
  3. DETECTION METHODOLOGY
  4. SERVICE PROVIDER FINGERPRINT TABLE
  5. TAKEOVER PROCEDURE — COMMON PROVIDERS
  6. NS TAKEOVER — HIGH SEVERITY
  7. MX TAKEOVER — EMAIL INTERCEPTION
  8. WILDCARD DNS RISKS
  9. DETECTION & EXPLOITATION DECISION TREE
  10. DEFENSE & REMEDIATION
  11. TRICK NOTES — WHAT AI MODELS MISS

What it can do on your machine

Read from SKILL.md and the folder at commit 6fbf0bc. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Subdomain Takeover loads about 2.6k tokens when it runs. Until then it costs about 75 tokens; SKILL.md has 814 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~75
When it runs · the whole SKILL.md, loaded when a task matches
~2.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yaklang/hack-skills at commit 6fbf0bc, republished under its MIT licence (© yaklang). 814 words, ~2,616 tokens.

Download SKILL.mdSave it as .claude/skills/subdomain-takeover/SKILL.md (or your agent's skills folder).
name
subdomain-takeover
description
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.

SKILL: Subdomain Takeover — Detection & Exploitation Playbook

AI LOAD INSTRUCTION: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the resource behind the CNAME is unclaimed and claimable.

1. CORE CONCEPT

Subdomain takeover occurs when:

  1. sub.target.com has a DNS record (CNAME, NS, A) pointing to an external service
  2. The external resource is no longer provisioned (deleted S3 bucket, removed Heroku app, etc.)
  3. The attacker can register/claim that exact resource name on the provider
  4. The attacker now controls content served under sub.target.com

Impact: cookie theft (parent domain cookies), OAuth token interception, phishing under trusted domain, CORS bypass, CSP bypass via whitelisted subdomain.

2. DETECTION METHODOLOGY

2.1 CNAME Enumeration
1. Collect subdomains (amass, subfinder, assetfinder, crt.sh, SecurityTrails)
2. Resolve DNS for each:
   dig CNAME sub.target.com +short
3. For each CNAME → check if the CNAME target returns NXDOMAIN or a provider error
4. Match error response against fingerprint table (Section 3)
2.2 Key Signals
SignalMeaning
CNAME → xxx.s3.amazonaws.com + HTTP 404 "NoSuchBucket"S3 bucket deleted, claimable
CNAME → xxx.herokuapp.com + "No such app"Heroku app deleted
CNAME → xxx.github.io + 404 "There isn't a GitHub Pages site here"GitHub Pages unclaimed
NXDOMAIN on the CNAME target domain itselfTarget domain expired or never existed
CNAME → provider but HTTP 200 with default parking pageMay or may not be claimable — verify
2.3 Automated Tools
ToolPurpose
subjackAutomated CNAME takeover checking
nuclei -t takeovers/Nuclei takeover detection templates
can-i-take-over-xyz (GitHub)Reference for which services are vulnerable
dnsreaperMulti-provider takeover scanner
subzyFast subdomain takeover verification

3. SERVICE PROVIDER FINGERPRINT TABLE

ProviderCNAME PatternFingerprint (HTTP Response)Claimable?
AWS S3*.s3.amazonaws.com / *.s3-website-*.amazonaws.comNoSuchBucket (404)Yes — create bucket with matching name
GitHub Pages*.github.ioThere isn't a GitHub Pages site here (404)Yes — create repo + enable Pages
Heroku*.herokuapp.com / *.herokudns.comNo such appYes — create app with matching name
Azure*.azurewebsites.net / *.cloudapp.azure.com / *.trafficmanager.netVarious default pages, NXDOMAINYes — register matching resource
Shopify*.myshopify.comSorry, this shop is currently unavailableYes — create shop, add custom domain
FastlyCNAME to Fastly edgeFastly error: unknown domainYes — add domain to Fastly service
Pantheon*.pantheonsite.io404 Site Not Found with Pantheon brandingYes
Tumblr*.tumblr.com (custom domain CNAME)There's nothing here / Whatever you were looking for doesn't existYes
WordPress.comCNAME to *.wordpress.comDo you want to registerYes — claim domain in WP.com
Zendesk*.zendesk.comHelp Center Closed / Zendesk branding on errorYes — create matching subdomain
Unbounce*.unbouncepages.comThe requested URL was not foundYes
Ghost*.ghost.io404 Not Found Ghost errorYes
Surge.sh*.surge.shproject not foundYes
Fly.ioCNAME to *.fly.devFly.io default 404Yes

4. TAKEOVER PROCEDURE — COMMON PROVIDERS

4.1 AWS S3
1. Confirm: curl -s http://sub.target.com → "NoSuchBucket"
2. Extract bucket name from CNAME (e.g., sub.target.com.s3.amazonaws.com → bucket = "sub.target.com")
3. aws s3 mb s3://sub.target.com --region <region>
4. Upload index.html proving control
5. Enable static website hosting
4.2 GitHub Pages
1. Confirm: curl -s https://sub.target.com → "There isn't a GitHub Pages site here"
2. Create GitHub repo (any name)
3. Add CNAME file containing "sub.target.com"
4. Enable GitHub Pages in repo settings
5. Wait for DNS propagation (GitHub verifies CNAME match)
4.3 Heroku
1. Confirm: curl -s http://sub.target.com → "No such app"
2. heroku create <app-name-from-cname>
3. heroku domains:add sub.target.com
4. Deploy proof-of-concept page

5. NS TAKEOVER — HIGH SEVERITY

NS takeover is far more dangerous than CNAME takeover: you control all DNS resolution for the zone.

Show full SKILL.md (318 more words)Show less
How It Happens
target.com NS → ns1.expireddomain.com
                 ↓
attacker registers expireddomain.com
                 ↓
attacker now controls ALL DNS for target.com
(A records, MX records, TXT records — everything)
Detection
1. Enumerate NS records: dig NS target.com +short
2. Check each NS domain: whois ns1.example.com → is the domain expired or available?
3. Also check: dig A ns1.example.com → NXDOMAIN/SERVFAIL?
4. Subdelegated zones: check NS for sub.target.com specifically
Impact
  • Full domain takeover (serve any content, intercept email, issue TLS certs via DNS-01)
  • Issue DV certificates from any CA using DNS challenge
  • Modify SPF/DKIM/DMARC → send authenticated email as target

6. MX TAKEOVER — EMAIL INTERCEPTION

When MX records point to deprovisioned mail services:

target.com MX → mail.deadservice.com (service discontinued)

If attacker can claim mail.deadservice.com or the mail tenant:

  • Receive password reset emails
  • Intercept sensitive communications
  • Potentially reset accounts that use email-based auth
Common Scenario

Expired Google Workspace / Microsoft 365 tenant → MX still points to Google/Microsoft → attacker creates new tenant and claims the domain.

7. WILDCARD DNS RISKS

If *.target.com has a wildcard CNAME to a claimable service:

  • Every undefined subdomain is vulnerable
  • anything.target.com can be taken over
  • Massively increases attack surface

Detection: dig A random1234567.target.com — if it resolves, wildcard exists.

8. DETECTION & EXPLOITATION DECISION TREE

Subdomain discovered (sub.target.com)?
├── Resolve DNS records
│   ├── Has CNAME → external service?
│   │   ├── HTTP response matches known fingerprint? (Section 3)
│   │   │   ├── YES → Attempt claim on provider (Section 4)
│   │   │   │   ├── Claim successful → TAKEOVER CONFIRMED
│   │   │   │   └── Claim blocked (name reserved, region locked) → document, try variations
│   │   │   └── NO → Service active, no takeover
│   │   └── CNAME target NXDOMAIN?
│   │       ├── Target is a registrable domain? → Register it → full control
│   │       └── Target is a subdomain of active provider → check provider claim process
│   │
│   ├── Has NS records → external nameserver?
│   │   ├── NS domain expired/available? → Register → FULL ZONE TAKEOVER
│   │   └── NS domain active → no takeover
│   │
│   ├── Has MX → external mail service?
│   │   ├── Mail service deprovisioned/claimable? → Claim tenant → EMAIL INTERCEPTION
│   │   └── Active mail service → no takeover
│   │
│   └── Has A record → IP address?
│       ├── IP belongs to elastic cloud (AWS EIP, Azure, GCP)?
│       │   ├── IP unassigned? → Claim IP → serve content
│       │   └── IP assigned to another customer → no takeover
│       └── IP belongs to dedicated server → no takeover
│
└── Post-takeover impact assessment
    ├── Shared cookies with parent domain? → Session hijacking
    ├── CORS trusts *.target.com? → Cross-origin data theft
    ├── CSP whitelists *.target.com? → XSS via taken-over subdomain
    ├── OAuth redirect_uri allows sub.target.com? → Token theft
    └── Can issue TLS cert for sub.target.com? → Full MITM

9. DEFENSE & REMEDIATION

ActionPriority
Remove DNS records when deprovisioning cloud resourcesCritical
Monitor CNAME targets for NXDOMAIN responsesHigh
Use DNS monitoring tools (SecurityTrails, DNSHistory)High
Claim/reserve resource names before deleting DNS recordsHigh
Audit NS delegations — ensure NS domains are owned and renewedCritical
Avoid wildcard CNAMEs to third-party servicesMedium
Implement Certificate Transparency monitoringMedium

10. TRICK NOTES — WHAT AI MODELS MISS

  1. CNAME ≠ takeover: A CNAME to S3 that returns 403 (bucket exists, private) is NOT vulnerable. Only NoSuchBucket (404) is.
  2. Region matters for S3: Bucket names are global, but website endpoints are regional. Try matching the region from the CNAME.
  3. GitHub Pages verification: GitHub added domain verification — org-verified domains cannot be claimed by others. Check if target uses this.
  4. Edge cases: Some providers (e.g., Cloudfront) require specific distribution configuration, not just domain claiming.
  5. Second-order takeover: sub.target.com CNAME → other.target.com CNAME → dead-service.com — the chain must be followed fully.
  6. SPF subdomain takeover: If SPF includes include:sub.target.com and you take over sub.target.com, you can modify its SPF TXT record to authorize your mail server → send spoofed email as target.com.

© yaklang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/subdomain-takeover of yaklang/hack-skills.

Open the folder on GitHubat commit 6fbf0bc

Compare with similar skills

Subdomain Takeover next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Subdomain Takeover compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Subdomain Takeover this skillyaklang/hack-skills2.4k—~2.6kAutomated safety check: PassMIT
Vulnerability Lookupptn1411/skill219—~1.1kAutomated safety check: PassNone
Metabigor OSINT Reconj3ssie/metabigor1.9k—~2.4kAutomated safety check: PassMIT
Cloud Bucket Exposure Finderforefy/.context152—~1.5kAutomated safety check: PassMIT
AWS Deploymentaws/agent-toolkit-for-aws2.8k—~1.8kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone

Similar skills

  • Vulnerability Lookup

    ptn1411/skill

    Multi-source threat intelligence and vulnerability lookup. An agent skill from ptn1411/skill.

    219 GitHub stars~1.1k tokensUpdated 18 days ago
    SecurityAuto-check passed

  • Metabigor OSINT Recon

    j3ssie/metabigor

    Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.

    1.9k GitHub stars~2.4k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Cloud Bucket Exposure Finder

    forefy/.context

    Turns a company's domains into likely storage bucket names and checks six cloud providers for publicly readable buckets, for authorized security assessments only.

    152 GitHub stars~1.5k tokensUpdated 5 days ago
    SecurityAuto-check passed

  • AWS Deployment

    aws/agent-toolkit-for-aws

    Official

    Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact.

    2.8k GitHub stars~1.8k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Fix Strix Security Findings

    usestrix/strix

    Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.

    68k GitHub stars~1.5k tokensUpdated yesterday
    SecurityAuto-check passed

More from yaklang/hack-skills

All 27 skills in this repo

  • Anti Debugging Techniques

    yaklang/hack-skills

    Anti-debugging detection and bypass playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~3.4k tokensUpdated 27 days ago
    Auto-check passed

  • API Auth And JWT Abuse

    yaklang/hack-skills

    API authentication and JWT abuse playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~567 tokensUpdated 27 days ago
    Auto-check passed

  • API Authorization And Bola

    yaklang/hack-skills

    API authorization and BOLA testing playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~449 tokensUpdated 27 days ago
    Auto-check passed

  • API Recon And Docs

    yaklang/hack-skills

    API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~456 tokensUpdated 27 days ago
    Auto-check passed

  • Attack Surface Mapping

    yaklang/hack-skills

    Draw a testable attack surface from one authorized target URL or one application.

    2.4k GitHub stars~2.6k tokensUpdated 27 days ago
    Auto-check passed

  • Classical Cipher Analysis

    yaklang/hack-skills

    Classical cipher analysis playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~4.8k tokensUpdated 27 days ago
    Auto-check passed

Works with

Categories

Questions about Subdomain Takeover

What does Subdomain Takeover do?

Subdomain takeover detection and exploitation playbook. An agent skill from yaklang/hack-skills. Subdomain Takeover is an agent skill from yaklang/hack-skills. Subdomain takeover detection and exploitation playbook.

When should I use Subdomain Takeover?

Subdomain Takeover fits situations like: targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources; expired third-party services; unclaimed SaaS tenants that an attacker can register to serve content under the victims domain.

How do I install Subdomain Takeover in Claude Code?

Run `npx skills add yaklang/hack-skills --skill subdomain-takeover -a claude-code`. Or copy the skill folder (skills/subdomain-takeover in yaklang/hack-skills) into .claude/skills/subdomain-takeover in your project. Claude Code loads it when a task matches its description.

How do I install Subdomain Takeover in Codex?

Run `npx skills add yaklang/hack-skills --skill subdomain-takeover -a codex`. Or copy the skill folder (skills/subdomain-takeover in yaklang/hack-skills) into .agents/skills/subdomain-takeover in your project. Codex loads it when a task matches its description.

Can I use Subdomain Takeover in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaklang/hack-skills --skill subdomain-takeover -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/subdomain-takeover, .gemini/skills/subdomain-takeover, .github/skills/subdomain-takeover and .opencode/skills/subdomain-takeover in your project.

What does Subdomain Takeover need to run?

SKILL.md names no scripts, command-line tools or credentials: Subdomain Takeover is instructions for the agent only.

Does Subdomain Takeover access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Subdomain Takeover safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Subdomain Takeover use?

Subdomain Takeover is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Subdomain Takeover use?

About 2.6k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Subdomain Takeover?

Skills that share tags, products or a category with Subdomain Takeover: Vulnerability Lookup (ptn1411/skill, 219 stars), Metabigor OSINT Recon (j3ssie/metabigor, 1.9k stars), Cloud Bucket Exposure Finder (forefy/.context, 152 stars) and AWS Deployment (aws/agent-toolkit-for-aws, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Subdomain Takeover?

yaklang (a GitHub organization) maintains it in yaklang/hack-skills, which has 2,418 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on September 13, 2026.

Source: yaklang/hack-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.