loading
Loading content
loading
Misconfiguration
Concurrent subdomain takeover checks against dangling CNAMEs.
overview
subjack reads subdomains from -w (or a single -d name), inspects each CNAME and the service response, and flags names that point at an unclaimed third-party service. Matching is fingerprint-driven against known takeover-prone providers.
Tune coverage with -t threads and -timeout. Force HTTPS with -ssl and probe every URL with -a when you want fewer misses. Enable -m to flag still-valid CNAMEs whose target no longer resolves, a common precursor to takeover.
Run it immediately after subdomain enumeration so every discovered name is tested. Trickest runs subjack as a managed Misconfiguration node that writes candidates to a file and folder. Verify each hit manually before you treat it as confirmed.
source github.com/haccer/subjack
use cases
Feed subjack the subdomains from your enumeration step so every name is checked for a dangling CNAME to an unclaimed service.
Run subjack concurrently across thousands of subdomains to cover a whole estate instead of spot-checking a handful.
Flag valid CNAMEs whose target no longer resolves, a state that often precedes a takeover opportunity.
Force HTTPS with -ssl and probe every URL with -a to reduce missed cases, then verify each flagged name by hand to drop false positives.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain or single subdomain to test. |
| wordlist | FILE | -w | Wordlist file of subdomains to scan. |
| config-file | FILE | -c | Path to the fingerprint configuration file. |
| threads | STRING | -t | Number of concurrent threads (default 10). |
| timeout-sec | STRING | -timeout | Seconds to wait before connection timeout (default 10). |
| force-ssl | STRING | -ssl | Force HTTPS connections, which may increase accuracy. |
| find-hidden-gems | BOOLEAN | -a | Send requests to every URL, not only those with identified CNAMEs. |
| presence-of-dead-record | BOOLEAN | -m | Flag a dead record with a still-valid CNAME entry. |
Showing key inputs. subjack exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain |
| threads | STRING | -t | Number of concurrent threads (Default: 10). |
| verbose | BOOLEAN | -v | Display more information per each request. |
| wordlist | FILE | -w | Wordlist file. |
| force-ssl | STRING | -ssl | Force HTTPS connections (May increase accuracy (Default: http://). |
| config-file | FILE | -c | Path to configuration file. |
| timeout-sec | STRING | -timeout | Seconds to wait before connection timeout (Default: 10). |
| find-hidden-gems | BOOLEAN | -a | Find those hidden gems by sending requests to every URL. (Default: Requests are only sent to URLs with identified CNAMEs) |
| presence-of-dead-record | BOOLEAN | -m | Flag the presence of a dead record, but valid CNAME entry. |
example
# scan a subdomain list for takeover candidatessubjack -w hosts.txt -t 50 -timeout 10 -ssl -a -m -v[Vulnerable] cms.example.com[Vulnerable] status.example.com[Vulnerable] docs.example.com[Dead Record] old-cdn.example.com[Vulnerable] help.example.com[Vulnerable] blog-staging.example.com[Dead Record] legacy-api.example.com[Vulnerable] shop-dev.example.comguidance
Use subjack to test enumerated subdomains for takeover right after discovery. Feed it subfinder or subbrute output. It reports candidates, not confirmed compromises, so verify flagged names by hand before acting.
Takeover scanner with an updatable fingerprint set. subjack is a concurrent Go option for large -w lists.
Template-based scanner with takeover templates among many checks. subjack is purpose-built for takeover at scale.
faq
A domain feeds subfinder, whose subdomains subjack tests for dangling CNAMEs, writing takeover candidates as output.
Facts on this page come from the live Trickest tool library.