loading
Loading content
loading
Vulnerabilities
Detect dangling DNS records and optionally claim them.
overview
After subdomain enumeration, tko-subs takes a host list and a providers CSV, then writes claimable dangling records as FILE and FOLDER output for triage.
Reach for it when CNAMEs still point at deprovisioned GitHub Pages, Heroku, or other CMS targets. Pass -domains or -domain, resolve with -server and -threads, and match fingerprints from -data.
Unlike subzy (fingerprint detection only), -takeover plus -githubtoken or -herokuapikey can claim the resource so a finding is confirmed rather than theoretical.
use cases
Feed a subdomain list and let tko-subs resolve each name and match it against the provider CSV, flagging the records that point at deprovisioned services.
Supply provider credentials and set the -takeover flag to claim a dangling resource, proving the finding rather than leaving it theoretical.
Point queries at a specific DNS server with -server and raise -threads so a large host list resolves quickly without overwhelming a single resolver.
Edit the CMS providers CSV passed via -data to add fingerprints for services the default set misses, keeping detection current as platforms change their error pages.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | -domains | List of domains to check. |
| domain | STRING | -domain | Domains to check, separated by commas. |
| server | STRING | -server | DNS server to direct queries to (default 8.8.8.8). |
| threads | STRING | -threads | Number of threads to run in parallel (default 5). |
| takeover | BOOLEAN | -takeover | Take over a vulnerable domain rather than only detecting it. |
| cms-providers-csv | FILE | -data | CSV of CMS provider strings used for identification. |
| github-token | STRING | -githubtoken | GitHub personal access token for claiming GitHub Pages records. |
| heroku-api-key | STRING | -herokuapikey | Heroku API key for claiming Heroku records. |
Showing key inputs. tko-subs exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| port | STRING | -port | The DNS server port (you shouldn't have to change this) (default: "53"). |
| domain | STRING | -domain | Domains separated by ",". |
| server | STRING | -server | A DNS server to direct queries to (default: "8.8.8.8"). |
| domains | FILE | -domains | List of domains to check |
| threads | STRING | -threads | Number of threads to run parallel (default: 5). |
| takeover | BOOLEAN | -takeover | Flag to denote if a vulnerable domain needs to be taken over or not (default: false). |
| github-token | STRING | -githubtoken | Github personal access token. |
| heroku-api-key | STRING | -herokuapikey | Heroku API key. |
| heroku-app-name | STRING | -herokuappname | Heroku app name. |
| heroku-username | STRING | -herokuusername | Heroku username. |
| cms-providers-csv | FILE | -data | CSV file containing CMS providers' string for identification (default: "providers-data.csv"). |
example
# detect dangling DNS records across a subdomain listtko-subs -domains subdomains.txt -data providers-data.csv -server 8.8.8.8 -threads 10cdn.example.com [CNAME] github.com - VULNERABLEassets.example.com [CNAME] s3.amazonaws.com - VULNERABLEapi.example.com [CNAME] app.example.net - NOT VULNERABLEapp.example.com [A] 198.51.100.10 - NOT VULNERABLEstaging.example.com [CNAME] pages.github.com - VULNERABLEdev.example.com [A] 203.0.113.20 - NOT VULNERABLEwww.example.com [A] 192.0.2.15 - NOT VULNERABLEguidance
Use tko-subs when you need dangling-DNS detection and optional reclaim. Match against an editable -data CSV; claim GitHub or Heroku with credentials. For fingerprint-only can-i-take-over-xyz checks, prefer subzy.
Detection only via can-i-take-over-xyz fingerprints. Quicker pass; tko-subs can also claim the resource.
Finds the subdomains to check. Run it before tko-subs to produce the domain list.
Has takeover templates among many other checks. tko-subs is purpose-built and can perform the takeover.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A subdomain list feeds tko-subs, which resolves each name, flags the dangling records, and writes the takeover candidates as an output.
Facts on this page come from the live Trickest tool library.