Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Vulnerabilities

subzy: check subdomains for takeover

Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.

Agent
Confirm takeovers across a discovered surfaceHunt dangling cloud and SaaS recordsKeep takeover scans focused

overview

What subzy does

subzy reads a subdomain list and tests each host for a takeover condition. It requests the host, reads the response, and matches it against the fingerprint set from the can-i-take-over-xyz project. When a subdomain points at a deprovisioned cloud service that still answers with a claimable error page, subzy flags it as vulnerable.

The check is response-driven, so it avoids many false positives that come from CNAME inspection alone. Scan a single host with -target, a comma-separated set, or a file via -targets. Tune -concurrency, -timeout, and -https to match the scope. Set -hide_fails to keep output on hosts worth acting on.

Place it after subdomain enumeration: discovery produces candidate names, subzy confirms which resolve to claimable services, and findings land as FILE and FOLDER output. Pair with tko-subs when you also need optional claim actions.

source github.com/LukaSikic/subzy

use cases

Where subzy fits

Confirm takeovers across a discovered surface

Feed a full subdomain list into subzy so every host is tested against the live fingerprint set, surfacing only the names that point at claimable, dangling services.

Hunt dangling cloud and SaaS records

Catch subdomains that still CNAME to a deleted S3 bucket, GitHub Pages site, or Heroku app, the exact conditions an attacker uses to hijack a domain.

Keep takeover scans focused

Set -hide_fails to drop non-vulnerable hosts and raise -concurrency so a wide scope finishes quickly with output that only lists actionable findings.

Re-scan on a schedule to catch new exposure

Wire discovery plus subzy into a scheduled Trickest workflow so newly created subdomains are tested for takeover as they appear, without a manual pass.

reference

subzy inputs and flags

7 inputs
NameTypeFlagDescription
targetSTRING-targetSingle or multiple subdomains separated by comma.
targetsFILE-targetsFile of subdomains to scan, the usual pipeline input.
concurrencySTRING-concurrencyNumber of concurrent checks (default 10).
timeoutSTRING-timeoutRequest timeout in seconds (default 10).
hide-failsBOOLEAN-hide_failsDo not display non-vulnerable results.
force-httpsBOOLEAN-httpsForce HTTPS when the target has no protocol defined.
dont-verify-sslBOOLEAN-verify_sslSkip sites with insecure SSL instead of returning an HTTP error.

Showing key inputs. subzy exposes 7 inputs in total.

example

Run subzy

subzy · command
# scan a subdomain list, hide non-vulnerable hosts, raise concurrencysubzy -targets subdomains.txt -hide_fails -concurrency 50 -timeout 15
sample output
[ VULNERABLE - GitHub Pages ]  https://assets.example.com[ VULNERABLE - Amazon S3 ]     https://cdn.example.com[ NOT VULNERABLE ]             https://api.example.com[ NOT VULNERABLE ]             https://app.example.com[ NOT VULNERABLE ]             https://staging.example.com[ HTTP ERROR ]                 https://legacy.example.comResults  vulnerable: 2  not vulnerable: 3  errors: 1

guidance

Choosing subzy

Reach for subzy when you have a subdomain list and need to know which hosts are takeover candidates. It matches can-i-take-over-xyz fingerprints on live HTTP responses, so it confirms claimable pages rather than dangling CNAMEs alone. Pair with subfinder upstream; use tko-subs when you also want optional claim/takeover actions.

tko-subs

Also detects dangling DNS records and can claim some of them. Uses a providers CSV rather than the can-i-take-over-xyz fingerprint set.

subfinder

Finds the subdomains first. Run it before subzy, not instead of it.

nuclei

Has takeover templates among many other checks. subzy is purpose-built for this one fingerprint job.

workflows

Workflows using subzy

2 workflows

  1. Find Subdomain Takeovers

    Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.

  2. Multi-Cloud Dangling DNS

    Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.

faq

subzy questions

It requests the host, reads the response, and matches it against the fingerprint set from the can-i-take-over-xyz project. When the error page indicates a claimable, deprovisioned service, subzy marks the host vulnerable. Reading the live response rather than the CNAME alone cuts many false positives from DNS inspection alone.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run subzy yourself

A domain feeds subfinder, which enumerates subdomains and passes them to subzy, which flags the takeover candidates as a queryable output.

Open subzy in the libraryView the workflow

Facts on this page come from the live Trickest tool library.