loading
Loading content
loading
Vulnerabilities
Subdomain takeover scanner with cloud-zone intake.
overview
dnsReaper tests candidates for takeover: DNS that still points at a deprovisioned cloud service someone else could claim. It matches each name against a large provider signature set and labels confidence (CONFIRMED, POTENTIAL, UNLIKELY).
Pull domains from --filename, a single --domain (with single), BIND, zone transfer, or live zones via aws, azure, cloudflare, or digitalocean credentials. That covers external bounty lists and internal blue-team DNS.
Run after subdomain discovery. Restrict with --signature or --exclude-signature when noise is high. --pipeline exits non-zero on detection so a Trickest step can fail closed; --out-format picks csv or json.
use cases
Scan discovered subdomains from a file against the full signature set to find dangling records pointing at deprovisioned services.
Fetch zones straight from Route53, Azure, Cloudflare, or DigitalOcean with credentials so the blue team audits live DNS, not a stale export.
Use the pipeline flag to exit non-zero when a takeover is found, failing a CI or workflow step on a real exposure.
Restrict to a single signature, exclude noisy ones, or toggle unlikely and probable checks to trade coverage against false positives.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| single-domain | STRING | --domain | Scan a single domain (with the single input set). |
| file-input | FILE | --filename | Scan a list of domains read from a file, one per line. |
| aws | BOOLEAN | aws | Fetch zones to scan straight from AWS Route53. |
| signature | STRING | --signature | Only scan with this signature. |
| exclude-signature | STRING | --exclude-signature | Skip a noisy signature. |
| out-format | STRING | --out-format | Write findings as csv or json. |
| pipeline | BOOLEAN | --pipeline | Exit non-zero on detection, to gate CI. |
| resolver | STRING | --resolver | Use a custom DNS resolver, or several comma-separated. |
Showing key inputs. dnsreaper exposes 33 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| aws | BOOLEAN | aws | Scan multiple domains fetched from AWS Route53 |
| bind | BOOLEAN | bind | Read domains from a DNS BIND zone file, or a path to multiple |
| file | BOOLEAN | file | Read domains from a file (or folder of files), one per line |
| azure | BOOLEAN | azure | Scan multiple domains fetched from Azure DNS services |
| single | BOOLEAN | single | Scan a single domain given on the command line |
| verbose | BOOLEAN | -v | Verbose output |
| nocolour | BOOLEAN | --nocolour | Turn off coloured text |
| pipeline | BOOLEAN | --pipeline | Exit non-zero on detection (used to fail a pipeline) |
| resolver | STRING | --resolver | Custom DNS resolver, or several comma-separated |
| signature | STRING | --signature | Only scan with this signature |
| cloudflare | BOOLEAN | cloudflare | Scan multiple domains fetched from Cloudflare |
| do-api-key | STRING | --do-api-key | DigitalOcean API key (requires the digitalocean input) |
| do-domains | STRING | --do-domains | Limit the scan to these domains (comma-separated) |
| file-input | FILE | --filename | List of domains to scan (requires the file input) |
| out-format | STRING | --out-format | Output format (csv or json) |
| parallelism | STRING | --parallelism | Number of domains to test in parallel; too high risks odd DNS results (default 30) |
| az-client-id | STRING | --az-client-id | Azure client ID (requires the azure input) |
| az-tenant-id | STRING | --az-tenant-id | Azure tenant ID (requires the azure input) |
| digitalocean | BOOLEAN | digitalocean | Scan multiple domains fetched from DigitalOcean |
| zonetransfer | BOOLEAN | zonetransfer | Scan multiple domains fetched via DNS zone transfer |
| extra-verbose | BOOLEAN | -vv | Extra verbose output |
| single-domain | STRING | --domain | Scan this one domain (requires the single input) |
| bind-zone-file | FILE | --bind-zone-file | BIND zone file (requires the bind input) |
| enable-unlikely | BOOLEAN | --enable-unlikely | Check more conditions, at a higher false-positive rate |
| az-client-secret | STRING | --az-client-secret | Azure client secret (requires the azure input) |
| cloudflare-token | STRING | --cloudflare-token | Cloudflare token (requires the cloudflare input) |
| disable-probable | BOOLEAN | --disable-probable | Do not check for probable conditions |
| aws-access-key-id | STRING | --aws-access-key-id | AWS access key ID (requires the aws input) |
| exclude-signature | STRING | --exclude-signature | Do not scan with this signature |
| az-subscription-id | STRING | --az-subscription-id | Azure subscription ID (requires the azure input) |
| zonetransfer-domain | STRING | --zonetransfer-domain | Root domain to scan for (requires the zonetransfer input) |
| aws-access-key-secret | STRING | --aws-access-key-secret | AWS access key secret (requires the aws input) |
| zonetransfer-nameserver | STRING | --zonetransfer-nameserver | DNS server FQDN (such as ns1.example.com) or IP address (requires the zonetransfer input) |
example
# scan a list of discovered subdomains as json and fail the run on any takeoverdnsreaper file --filename subdomains.txt --out-format json --pipeline🚀 Testing 42 domains with 54 signatures...100%|██████████████████████████████| 42/42 [00:07<00:00, 5.94it/s][CONFIRMED] app.example.com -> signature: aws_s3[CONFIRMED] cdn.example.com -> signature: azure_traffic_manager[POTENTIAL] docs.example.com -> signature: github[UNLIKELY] mail.example.com -> signature: fastly💥 We found 2 takeovers!!!Results written to output/ in csv and jsonguidance
Use after discovery when you need broad takeover signature coverage or cloud-zone ingestion. Prefer subjack or tko-subs for a lighter CNAME-focused check. Use subfinder or amass to build the subdomain list first.
Fast CNAME-based takeover check. dnsReaper adds a larger signature set and cloud-zone pulls.
Classic provider-list takeover scan. dnsReaper covers more services and input sources.
Lightweight takeover verifier. dnsReaper adds cloud-account intake and --pipeline gating.
faq
related
Automates OS command injection detection and exploitation.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.
subfinder enumerates a domain subdomains, then dnsReaper scans them against takeover signatures and writes confirmed takeovers as output.
Facts on this page come from the live Trickest tool library.