loading
Loading content
loading
Recon
Multi-cloud dangling DNS detection via zone-to-inventory diff, not wordlists.
overview
findmytakeover scans DNS zones and cloud infrastructure you authorize, then reports DNS records whose backing resources no longer exist. It works from inventory, not a subdomain wordlist, so it catches gone buckets, load balancers, and pages that public fingerprint scanners never see.
Point it at a YAML config with --config-file that enables AWS, GCP, Azure, Cloudflare, and/or OCI for DNS and infra collection. With --verify-dns (default on) it also resolves known SaaS takeover fingerprints and treats confirmed NXDOMAIN targets as high confidence. Use --no-verify-dns when you want inventory diff only with no outbound DNS lookups.
On Trickest the Library workflow Multi-Cloud Dangling DNS assembles that config from vault bind scripts, runs findmytakeover, and emits a findings report. Smoke with providers disabled fails closed on missing cloud config instead of inventing a clean multi-cloud result.
use cases
Diff each enabled cloud DNS zone against live inventory so records pointing at deleted resources show up as soon as the infra is gone, not when a wordlist happens to guess the name.
Enable the providers you own in the config file and scan accounts, projects, subscriptions, zones, or compartments in parallel instead of running a separate tool per cloud.
Leave --verify-dns on so fingerprinted SaaS targets (Fastly, GitHub Pages-class suffixes, and others) are resolved. NXDOMAIN confirms high-confidence dangling; wildcarded providers stay in an unconfirmed worklist.
Wire findmytakeover into a Trickest workflow with vault-bound credentials and re-run when accounts or zones change so new dangling records appear as a diff, not a one-off audit.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| config-file | FILE | --config-file | findmytakeover YAML config (providers, accounts, credentials, excludes). |
| verify-dns | BOOLEAN | --verify-dns | Resolve third-party SaaS fingerprints to confirm NXDOMAIN dangling records (default on). |
Showing key inputs. findmytakeover exposes 2 inputs in total.
example
# inventory + SaaS NXDOMAIN checks from a provider configfindmytakeover --config-file findmytakeover.config --verify-dns --json findings.json{ "tool": "findmytakeover", "version": "2.0.0", "summary": { "total": 2, "high_confidence": 1, "by_target_owner": { "Amazon Web Services": 2 } }, "findings": [ { "record": "cdn.example.com", "target": "gone-cdn.example.com", "dns_provider": "Amazon Web Services", "target_owner": "Amazon Web Services", "dns_status": "nxdomain", "confidence": "high" }, { "record": "legacy.example.com", "target": "old-bucket.s3.amazonaws.com", "dns_provider": "Amazon Web Services", "target_owner": "Amazon Web Services", "confidence": "inventory-miss" } ]}guidance
Reach for findmytakeover when you can authorize cloud DNS and inventory APIs and need dangling records across AWS, GCP, Azure, Cloudflare, or OCI. Use subzy or nuclei takeover templates when you only have a public subdomain list and no cloud credentials.
HTTP fingerprint checks on a subdomain list (can-i-take-over-xyz). No cloud inventory. Pair when you lack vault credentials for findmytakeover.
Has takeover templates among many other checks. Useful on public hosts; does not diff cloud DNS zones against live infra.
Providers-CSV takeover detector with optional claim actions. Inventory-free; not a multi-cloud zone diff.
workflows
faq
related
Multi-source subdomain discovery; hand names to httpx.
OWASP Amass intel: map an organization's root domains and ranges.
Find domains and subdomains potentially related to a given domain.
Modular OSINT recon that chains modules from a seed target.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Authorized cloud config feeds findmytakeover, which diffs DNS zones against live inventory and emits dangling-record findings.
Facts on this page come from the live Trickest tool library.