How a subdomain takeover works

  1. A team creates shop.example.com with a CNAME record pointing to a third-party service, for example a cloud app or storage bucket.
  2. Later the service is cancelled or deleted, but the DNS record is left in place. This is a dangling DNS record.
  3. An attacker finds the record, registers the same resource name on that provider, and the subdomain now resolves to content they control.
  4. Because the content is served from a genuine company subdomain, it can pass casual inspection, inherit cookies scoped to the parent domain and, in some cases, obtain a valid TLS certificate.

Why it is dangerous

  • Phishing that looks legitimate. Links on the real domain are far more convincing than a lookalike.
  • Cookie and session theft. Cookies scoped to .example.com may be sent to the attacker's page.
  • Reputation and SEO damage. Attackers have used taken-over subdomains to host spam and gambling content.
  • Bypassing allow lists. Security tools and content policies that trust your domain will trust the attacker's content too.

How to prevent subdomain takeover

  1. Remove or update DNS records before, not after, de-provisioning the service they point to.
  2. Keep an inventory of subdomains and what each one points at.
  3. Monitor DNS continuously for records that resolve to unclaimed resources.
  4. Limit who can create DNS records, and require an owner for each one.

How DarkInvader helps

DarkInvader's DNS Monitoring and Asset Discovery find subdomains linked to your organisation, check what each one points to, and flag records that resolve to deleted or unclaimed services before an attacker can claim them.

Explore DNS Monitoring

Frequently asked questions

What causes a subdomain takeover?

A DNS record, usually a CNAME, that still points to an external service after that service has been removed. The record is the vulnerability, and the attacker simply claims the resource it points to.

Which services are vulnerable to subdomain takeover?

Any provider that lets a customer claim a named resource without proving ownership of the domain pointing at it. Cloud hosting, storage, website builders and help desk platforms have all been affected at various times, and some providers have since added verification.

How do I check for subdomain takeover?

List your subdomains, resolve each one, and check whether the target service still exists and belongs to you. Doing this manually is slow, which is why continuous automated monitoring is the usual approach.

Related terms and reading

Sources