Scan subdomains for takeover via dangling CNAMEs

subjack hunts for subdomain takeover. It reads a list of subdomains, checks each one's CNAME and the response of the service it points to, and flags names whose target points at an unclaimed third-party service that an attacker could register and control. The check is fingerprint-driven, matching the tell-tale responses of takeover-prone providers.

Speed is its strength. Written in Go and run concurrently, it covers large subdomain lists, which makes it practical to test an entire enumerated surface rather than spot-checking a few names. A dead-record mode flags valid CNAMEs whose target no longer resolves, a common precursor to takeover.

On Trickest, subjack is a Misconfiguration node that takes a domain or wordlist and writes a file and a folder of results. Run it right after subdomain enumeration so every name you found is tested for takeover, then verify any hit manually to rule out false positives.