Misconfiguration
Find dangling CNAMEs that enable subdomain takeover
subjack is a DNS takeover scanner written in Go that scans a list of domains concurrently and identifies ones able to be hijacked because they point at unclaimed third-party services.
installgo install github.com/haccer/subjack@latest
Go · MIT license
overview
What subjack does
subjack reads subdomains from -w (or a single -d name), inspects each CNAME and the service response, and flags names that point at an unclaimed third-party service. Matching is fingerprint-driven against known takeover-prone providers.
Tune coverage with -t threads and -timeout. Force HTTPS with -ssl and probe every URL with -a when you want fewer misses. Enable -m to flag still-valid CNAMEs whose target no longer resolves, a common precursor to takeover.
Run it immediately after subdomain enumeration so every discovered name is tested. Trickest runs subjack as a managed Misconfiguration node that writes candidates to a file and folder. Verify each hit manually before you treat it as confirmed.
source github.com/haccer/subjack
use cases
Where subjack fits
Scan an enumerated surface for takeover
Feed subjack the subdomains from your enumeration step so every name is checked for a dangling CNAME to an unclaimed service.
Test large lists fast
Run subjack concurrently across thousands of subdomains to cover a whole estate instead of spot-checking a handful.
Catch dead-record precursors
Flag valid CNAMEs whose target no longer resolves, a state that often precedes a takeover opportunity.
Improve accuracy on hits
Force HTTPS with -ssl and probe every URL with -a to reduce missed cases, then verify each flagged name by hand to drop false positives.
reference
subjack inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain or single subdomain to test. |
| wordlist | FILE | -w | Wordlist file of subdomains to scan. |
| config-file | FILE | -c | Path to the fingerprint configuration file. |
| threads | STRING | -t | Number of concurrent threads (default 10). |
| timeout-sec | STRING | -timeout | Seconds to wait before connection timeout (default 10). |
| force-ssl | STRING | -ssl | Force HTTPS connections, which may increase accuracy. |
| find-hidden-gems | BOOLEAN | -a | Send requests to every URL, not only those with identified CNAMEs. |
| presence-of-dead-record | BOOLEAN | -m | Flag a dead record with a still-valid CNAME entry. |
Showing key inputs. subjack exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain |
| threads | STRING | -t | Number of concurrent threads (Default: 10). |
| verbose | BOOLEAN | -v | Display more information per each request. |
| wordlist | FILE | -w | Wordlist file. |
| force-ssl | STRING | -ssl | Force HTTPS connections (May increase accuracy (Default: http://). |
| config-file | FILE | -c | Path to configuration file. |
| timeout-sec | STRING | -timeout | Seconds to wait before connection timeout (Default: 10). |
| find-hidden-gems | BOOLEAN | -a | Find those hidden gems by sending requests to every URL. (Default: Requests are only sent to URLs with identified CNAMEs) |
| presence-of-dead-record | BOOLEAN | -m | Flag the presence of a dead record, but valid CNAME entry. |
example
Run subjack
# scan a subdomain list for takeover candidates
subjack -w hosts.txt -t 50 -timeout 10 -ssl -a -m -v[Vulnerable] cms.example.com
[Vulnerable] status.example.com
[Vulnerable] docs.example.com
[Dead Record] old-cdn.example.com
[Vulnerable] help.example.com
[Vulnerable] blog-staging.example.com
[Dead Record] legacy-api.example.com
[Vulnerable] shop-dev.example.comguidance
Choosing subjack
Use subjack to test enumerated subdomains for takeover right after discovery. Feed it subfinder or subbrute output. It reports candidates, not confirmed compromises, so verify flagged names by hand before acting.
subzy
Takeover scanner with an updatable fingerprint set. subjack is a concurrent Go option for large -w lists.
nuclei
Template-based scanner with takeover templates among many checks. subjack is purpose-built for takeover at scale.
faq
subjack questions
Run subjack yourself
A domain feeds subfinder, whose subdomains subjack tests for dangling CNAMEs, writing takeover candidates as output.
Facts on this page come from the live Trickest tool library.