Detect dangling DNS records that enable subdomain takeovers

tko-subs scans subdomains for dangling DNS records, the CNAMEs that still point at a cloud service or CMS that has been deprovisioned. It resolves each name, compares the answer against a CSV of provider fingerprints, and flags hosts whose record now leads to a claimable resource. Those are the conditions behind a subdomain takeover, where an attacker registers the abandoned resource and serves content from a domain you own.

It goes a step past detection. With the -takeover flag and provider credentials, it can claim the dangling resource for you, which is useful for confirming a finding or for defenders reclaiming their own records. The provider data lives in a CSV you can extend, and you control the DNS server, port, and thread count to tune resolution behavior at scale.

In a Trickest Vulnerabilities workflow, tko-subs takes a domain list and a providers CSV and writes a file and a folder of results. Place it after subdomain enumeration so discovery produces the names and tko-subs confirms which ones resolve to claimable services.