Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 13, 2026

Vulnerabilities

subzy: check subdomains for takeover

Subzy is a subdomain takeover tool written in Go that checks each subdomain's HTTP response against fingerprints from the can-i-take-over-xyz project to flag hosts pointing at claimable, deprovisioned services.

installgo install -v github.com/PentestPad/subzy@latest

Go · GPL-2.0 license

Agent
Confirm takeovers across a discovered surfaceHunt dangling cloud and SaaS recordsKeep takeover scans focused

overview

What subzy does

subzy reads a subdomain list and tests each host for a takeover condition. It requests the host, reads the response, and matches it against the fingerprint set from the can-i-take-over-xyz project. When a subdomain points at a deprovisioned cloud service that still answers with a claimable error page, subzy flags it as vulnerable.

The check is response-driven, so it avoids many false positives that come from CNAME inspection alone. Scan a single host with -target, a comma-separated set, or a file via -targets. Tune -concurrency, -timeout, and -https to match the scope. Set -hide_fails to keep output on hosts worth acting on.

Place it after subdomain enumeration: discovery produces candidate names, subzy confirms which resolve to claimable services, and findings land as FILE and FOLDER output. Pair with tko-subs when you also need optional claim actions.

source github.com/PentestPad/subzy

use cases

Where subzy fits

Confirm takeovers across a discovered surface

Feed a full subdomain list into subzy so every host is tested against the live fingerprint set, surfacing only the names that point at claimable, dangling services.

Hunt dangling cloud and SaaS records

Catch subdomains that still CNAME to a deleted S3 bucket, GitHub Pages site, or Heroku app, the exact conditions an attacker uses to hijack a domain.

Keep takeover scans focused

Set -hide_fails to drop non-vulnerable hosts and raise -concurrency so a wide scope finishes quickly with output that only lists actionable findings.

Re-scan on a schedule to catch new exposure

Wire discovery plus subzy into a scheduled Trickest workflow so newly created subdomains are tested for takeover as they appear, without a manual pass.

reference

subzy inputs and flags

7 inputs
NameTypeFlagDescription
targetSTRING-targetSingle or multiple subdomains separated by comma.
targetsFILE-targetsFile of subdomains to scan, the usual pipeline input.
concurrencySTRING-concurrencyNumber of concurrent checks (default 10).
timeoutSTRING-timeoutRequest timeout in seconds (default 10).
hide-failsBOOLEAN-hide_failsDo not display non-vulnerable results.
force-httpsBOOLEAN-httpsForce HTTPS when the target has no protocol defined.
dont-verify-sslBOOLEAN-verify_sslSkip sites with insecure SSL instead of returning an HTTP error.

Showing key inputs. subzy exposes 7 inputs in total.

example

Run subzy

subzy · command
# scan a subdomain list, hide non-vulnerable hosts, raise concurrency
subzy -targets subdomains.txt -hide_fails -concurrency 50 -timeout 15
sample output
[ VULNERABLE - GitHub Pages ]  https://assets.example.com
[ VULNERABLE - Amazon S3 ]     https://cdn.example.com
[ NOT VULNERABLE ]             https://api.example.com
[ NOT VULNERABLE ]             https://app.example.com
[ NOT VULNERABLE ]             https://staging.example.com
[ HTTP ERROR ]                 https://legacy.example.com
Results  vulnerable: 2  not vulnerable: 3  errors: 1

guidance

Choosing subzy

Reach for subzy when you have a subdomain list and need to know which hosts are takeover candidates. It matches can-i-take-over-xyz fingerprints on live HTTP responses, so it confirms claimable pages rather than dangling CNAMEs alone. Pair with subfinder upstream; use tko-subs when you also want optional claim/takeover actions.

tko-subs

Also detects dangling DNS records and can claim some of them. Uses a providers CSV rather than the can-i-take-over-xyz fingerprint set.

subfinder

Finds the subdomains first. Run it before subzy, not instead of it.

nuclei

Has takeover templates among many other checks. subzy is purpose-built for this one fingerprint job.

workflows

Workflows using subzy

2 workflows

  1. Find Subdomain Takeovers

    Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.

  2. Multi-Cloud Dangling DNS

    Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.

faq

subzy questions

The project moved to PentestPad/subzy and newer releases take a run subcommand with double-dash flags: go install -v github.com/PentestPad/subzy@latest, then subzy run --targets subdomains.txt --hide_fails. The single-dash form on this page is the original LukaSikic release, which is the version the Trickest node runs. PentestPad/subzy on GitHub.

It requests the host, reads the response, and matches it against the fingerprint set from the can-i-take-over-xyz project. When the error page indicates a claimable, deprovisioned service, subzy marks the host vulnerable. Reading the live response rather than the CNAME alone cuts many false positives from DNS inspection alone.

A dangling CNAME does not always mean a claimable page. subzy requests each host and matches can-i-take-over-xyz fingerprints in the body, so you only triage hosts whose live response looks claimable. Use -hide_fails to drop clean hosts from the output.

Pass a file with -targets, raise -concurrency above the default 10 for a wide scope, and set -hide_fails so the output lists only takeover candidates. -timeout controls how long each request waits before subzy moves on.

No. subzy works on HTTP and HTTPS responses, so it finds service and CNAME takeovers, not dangling nameserver delegations or zone-level issues. For a dangling NS record you need a DNS-focused check; subzy covers the response-fingerprint class that can-i-take-over-xyz tracks.

Both hunt takeover conditions. subzy matches live responses against can-i-take-over-xyz fingerprints and stays detection-focused. tko-subs uses a providers CSV and can optionally claim some dangling resources; use that when you need the claim path, not just detection.

Remove the dangling DNS record or reclaim the resource it points at. If the subdomain no longer needs to exist, delete the CNAME; if it does, re-create the target service under your account so the name resolves to something you control. Re-run subzy afterward to confirm the host no longer matches a takeover fingerprint.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run subzy yourself

A domain feeds subfinder, which enumerates subdomains and passes them to subzy, which flags the takeover candidates as a queryable output.

Open subzy in the libraryView the workflow

Facts on this page come from the live Trickest tool library.