Vulnerabilities
Scan subdomains for takeover with signature matching
Subdomain takeover scanner with cloud-zone intake.
overview
What dnsreaper does
dnsReaper tests candidates for takeover: DNS that still points at a deprovisioned cloud service someone else could claim. It matches each name against a large provider signature set and labels confidence (CONFIRMED, POTENTIAL, UNLIKELY).
Pull domains from --filename, a single --domain (with single), BIND, zone transfer, or live zones via aws, azure, cloudflare, or digitalocean credentials. That covers external bounty lists and internal blue-team DNS.
Run after subdomain discovery. Restrict with --signature or --exclude-signature when noise is high. --pipeline exits non-zero on detection so a Trickest step can fail closed; --out-format picks csv or json.
use cases
Where dnsreaper fits
Hunt subdomain takeovers across a list
Scan discovered subdomains from a file against the full signature set to find dangling records pointing at deprovisioned services.
Sweep your own cloud DNS
Fetch zones straight from Route53, Azure, Cloudflare, or DigitalOcean with credentials so the blue team audits live DNS, not a stale export.
Gate a pipeline on detection
Use the pipeline flag to exit non-zero when a takeover is found, failing a CI or workflow step on a real exposure.
Tune the signal-to-noise
Restrict to a single signature, exclude noisy ones, or toggle unlikely and probable checks to trade coverage against false positives.
reference
dnsreaper inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| single-domain | STRING | --domain | Scan a single domain (with the single input set). |
| file-input | FILE | --filename | Scan a list of domains read from a file, one per line. |
| aws | BOOLEAN | aws | Fetch zones to scan straight from AWS Route53. |
| signature | STRING | --signature | Only scan with this signature. |
| exclude-signature | STRING | --exclude-signature | Skip a noisy signature. |
| out-format | STRING | --out-format | Write findings as csv or json. |
| pipeline | BOOLEAN | --pipeline | Exit non-zero on detection, to gate CI. |
| resolver | STRING | --resolver | Use a custom DNS resolver, or several comma-separated. |
Showing key inputs. dnsreaper exposes 33 inputs in total.
Full flag reference (33 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| aws | BOOLEAN | aws | Scan multiple domains fetched from AWS Route53 |
| bind | BOOLEAN | bind | Read domains from a DNS BIND zone file, or a path to multiple |
| file | BOOLEAN | file | Read domains from a file (or folder of files), one per line |
| azure | BOOLEAN | azure | Scan multiple domains fetched from Azure DNS services |
| single | BOOLEAN | single | Scan a single domain given on the command line |
| verbose | BOOLEAN | -v | Verbose output |
| nocolour | BOOLEAN | --nocolour | Turn off coloured text |
| pipeline | BOOLEAN | --pipeline | Exit non-zero on detection (used to fail a pipeline) |
| resolver | STRING | --resolver | Custom DNS resolver, or several comma-separated |
| signature | STRING | --signature | Only scan with this signature |
| cloudflare | BOOLEAN | cloudflare | Scan multiple domains fetched from Cloudflare |
| do-api-key | STRING | --do-api-key | DigitalOcean API key (requires the digitalocean input) |
| do-domains | STRING | --do-domains | Limit the scan to these domains (comma-separated) |
| file-input | FILE | --filename | List of domains to scan (requires the file input) |
| out-format | STRING | --out-format | Output format (csv or json) |
| parallelism | STRING | --parallelism | Number of domains to test in parallel; too high risks odd DNS results (default 30) |
| az-client-id | STRING | --az-client-id | Azure client ID (requires the azure input) |
| az-tenant-id | STRING | --az-tenant-id | Azure tenant ID (requires the azure input) |
| digitalocean | BOOLEAN | digitalocean | Scan multiple domains fetched from DigitalOcean |
| zonetransfer | BOOLEAN | zonetransfer | Scan multiple domains fetched via DNS zone transfer |
| extra-verbose | BOOLEAN | -vv | Extra verbose output |
| single-domain | STRING | --domain | Scan this one domain (requires the single input) |
| bind-zone-file | FILE | --bind-zone-file | BIND zone file (requires the bind input) |
| enable-unlikely | BOOLEAN | --enable-unlikely | Check more conditions, at a higher false-positive rate |
| az-client-secret | STRING | --az-client-secret | Azure client secret (requires the azure input) |
| cloudflare-token | STRING | --cloudflare-token | Cloudflare token (requires the cloudflare input) |
| disable-probable | BOOLEAN | --disable-probable | Do not check for probable conditions |
| aws-access-key-id | STRING | --aws-access-key-id | AWS access key ID (requires the aws input) |
| exclude-signature | STRING | --exclude-signature | Do not scan with this signature |
| az-subscription-id | STRING | --az-subscription-id | Azure subscription ID (requires the azure input) |
| zonetransfer-domain | STRING | --zonetransfer-domain | Root domain to scan for (requires the zonetransfer input) |
| aws-access-key-secret | STRING | --aws-access-key-secret | AWS access key secret (requires the aws input) |
| zonetransfer-nameserver | STRING | --zonetransfer-nameserver | DNS server FQDN (such as ns1.example.com) or IP address (requires the zonetransfer input) |
example
Run dnsreaper
# scan a list of discovered subdomains as json and fail the run on any takeoverdnsreaper file --filename subdomains.txt --out-format json --pipeline🚀 Testing 42 domains with 54 signatures...100%|██████████████████████████████| 42/42 [00:07<00:00, 5.94it/s][CONFIRMED] app.example.com -> signature: aws_s3[CONFIRMED] cdn.example.com -> signature: azure_traffic_manager[POTENTIAL] docs.example.com -> signature: github[UNLIKELY] mail.example.com -> signature: fastly💥 We found 2 takeovers!!!Results written to output/ in csv and jsonguidance
Choosing dnsreaper
Use after discovery when you need broad takeover signature coverage or cloud-zone ingestion. Prefer subjack or tko-subs for a lighter CNAME-focused check. Use subfinder or amass to build the subdomain list first.
subjack
Fast CNAME-based takeover check. dnsReaper adds a larger signature set and cloud-zone pulls.
tko-subs
Classic provider-list takeover scan. dnsReaper covers more services and input sources.
subzy
Lightweight takeover verifier. dnsReaper adds cloud-account intake and --pipeline gating.
faq
dnsreaper questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
honeymcp
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
Run dnsreaper yourself
subfinder enumerates a domain subdomains, then dnsReaper scans them against takeover signatures and writes confirmed takeovers as output.
Facts on this page come from the live Trickest tool library.