How do I reduce false positives?

Force HTTPS with -ssl and probe every URL with -a. Still verify each flagged name manually; fingerprint matches can miss or over-report depending on provider behavior.

Should I use -d or -w?

Use -d for one domain or subdomain. Use -w with a wordlist file when you have many names from enumeration.

-m marks a dead record that still has a valid CNAME entry. That state often precedes a clear HTTP fingerprint hit.

How do I raise concurrency?

Set -t for thread count and -timeout for per-connection wait. Higher -t speeds mass testing; keep timeouts realistic for the network path.

Updated Jul 15, 2026

Misconfiguration

Find dangling CNAMEs that enable subdomain takeover

Concurrent subdomain takeover checks against dangling CNAMEs.

Scan an enumerated surface for takeover Test large lists fast Catch dead-record precursors

overview

What subjack does

subjack reads subdomains from -w (or a single -d name), inspects each CNAME and the service response, and flags names that point at an unclaimed third-party service. Matching is fingerprint-driven against known takeover-prone providers.

Tune coverage with -t threads and -timeout. Force HTTPS with -ssl and probe every URL with -a when you want fewer misses. Enable -m to flag still-valid CNAMEs whose target no longer resolves, a common precursor to takeover.

Run it immediately after subdomain enumeration so every discovered name is tested. Trickest runs subjack as a managed Misconfiguration node that writes candidates to a file and folder. Verify each hit manually before you treat it as confirmed.

source github.com/haccer/subjack

use cases

Where subjack fits

Scan an enumerated surface for takeover

Feed subjack the subdomains from your enumeration step so every name is checked for a dangling CNAME to an unclaimed service.

Test large lists fast

Run subjack concurrently across thousands of subdomains to cover a whole estate instead of spot-checking a handful.

Catch dead-record precursors

Flag valid CNAMEs whose target no longer resolves, a state that often precedes a takeover opportunity.

Improve accuracy on hits

Force HTTPS with -ssl and probe every URL with -a to reduce missed cases, then verify each flagged name by hand to drop false positives.

reference

subjack inputs and flags

9 inputs

Name	Type	Flag	Description
domain	STRING	-d	Domain or single subdomain to test.
wordlist	FILE	-w	Wordlist file of subdomains to scan.
config-file	FILE	-c	Path to the fingerprint configuration file.
threads	STRING	-t	Number of concurrent threads (default 10).
timeout-sec	STRING	-timeout	Seconds to wait before connection timeout (default 10).
force-ssl	STRING	-ssl	Force HTTPS connections, which may increase accuracy.
find-hidden-gems	BOOLEAN	-a	Send requests to every URL, not only those with identified CNAMEs.
presence-of-dead-record	BOOLEAN	-m	Flag a dead record with a still-valid CNAME entry.

Showing key inputs. subjack exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
domain	STRING	-d	Domain
threads	STRING	-t	Number of concurrent threads (Default: 10).
verbose	BOOLEAN	-v	Display more information per each request.
wordlist	FILE	-w	Wordlist file.
force-ssl	STRING	-ssl	Force HTTPS connections (May increase accuracy (Default: http://).
config-file	FILE	-c	Path to configuration file.
timeout-sec	STRING	-timeout	Seconds to wait before connection timeout (Default: 10).
find-hidden-gems	BOOLEAN	-a	Find those hidden gems by sending requests to every URL. (Default: Requests are only sent to URLs with identified CNAMEs)
presence-of-dead-record	BOOLEAN	-m	Flag the presence of a dead record, but valid CNAME entry.

example

Run subjack

subjack · command

# scan a subdomain list for takeover candidatessubjack -w hosts.txt -t 50 -timeout 10 -ssl -a -m -v

sample output

[Vulnerable] cms.example.com[Vulnerable] status.example.com[Vulnerable] docs.example.com[Dead Record] old-cdn.example.com[Vulnerable] help.example.com[Vulnerable] blog-staging.example.com[Dead Record] legacy-api.example.com[Vulnerable] shop-dev.example.com

guidance

Choosing subjack

Use subjack to test enumerated subdomains for takeover right after discovery. Feed it subfinder or subbrute output. It reports candidates, not confirmed compromises, so verify flagged names by hand before acting.

subzy

Takeover scanner with an updatable fingerprint set. subjack is a concurrent Go option for large -w lists.

nuclei

Template-based scanner with takeover templates among many checks. subjack is purpose-built for takeover at scale.

faq

subjack questions

A name whose CNAME points at a third-party service that is no longer claimed. Fingerprints match provider responses that indicate the service can be registered. An attacker who claims it can serve content on that subdomain.

Run subjack yourself

A domain feeds subfinder, whose subdomains subjack tests for dangling CNAMEs, writing takeover candidates as output.

Open subjack in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.