Subdomain Takeover & Dangling DNS Scanner

Detect abandoned CNAME records pointing to decommissioned third-party cloud providers (AWS, S3, Vercel, GitHub).

Technical Scope & Verification Behavior

Scans DNS records against known fingerprint signatures of 40+ cloud hosting services to spot claimable unclaimed tenant subdomains.

Automated Inspection Checks (18)

Passive URL parameter fuzzing

Non-destructive boundary tests

Header & cookie flag assertions

Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

docs.example.com CNAME -> unclaimed-bucket.s3.amazonaws.com

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)

Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

DNS Record Cleanup

patch.diff (dns)

--- a/handler.dns (Vulnerable)

docs.example.com. 300 IN CNAME old-service.herokuapp.com.

+++ b/handler.dns (Remediated)

; Delete dangling CNAME or re-point to active service

Audit your DNS zone files and immediately delete CNAME records whose backing cloud resource has been decommissioned.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Log into your DNS provider and delete the dangling CNAME record for this subdomain to prevent unauthorized takeover."

Run Isolated Check

Test your public domain specifically for Subdomain Takeover & Dangling DNS Scanner.

100% passive • No server load

Specification Details

CVSS Score: 8.8 / 10.0
Severity Level: HIGH
Category: VULNERABILITY
Test Vectors: 18 automated
Execution SLA: < 2.5 seconds
False Positive Defense: Strict assertion

Related Standards

#DNS#Takeover#CNAME#Cloud

Frequently Audited Together

Checks commonly evaluated alongside Subdomain Takeover & Dangling DNS Scanner during surface discovery.

View all 41 checks →

VULNERABILITY

SQL Injection Scanner

Detect SQL injection vulnerabilities in your web application before attackers exploit database access.

CVSS 9.8

VULNERABILITY

Cross-Site Scripting (XSS) Scanner

Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.

CVSS 8.2

VULNERABILITY

API Key Exposure Scanner

Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.

CVSS 9.4

Run continuous monitoring for Subdomain Takeover & Dangling DNS Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog