Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Flag dangling DNS records that enable subdomain takeovers

Detect dangling DNS records and optionally claim them.

Agent
Detect dangling DNS records at scaleConfirm a takeover by claiming the resourceTune resolution for wide scopes

overview

What tko-subs does

After subdomain enumeration, tko-subs takes a host list and a providers CSV, then writes claimable dangling records as FILE and FOLDER output for triage.

Reach for it when CNAMEs still point at deprovisioned GitHub Pages, Heroku, or other CMS targets. Pass -domains or -domain, resolve with -server and -threads, and match fingerprints from -data.

Unlike subzy (fingerprint detection only), -takeover plus -githubtoken or -herokuapikey can claim the resource so a finding is confirmed rather than theoretical.

source github.com/anshumanbh/tko-subs

use cases

Where tko-subs fits

Detect dangling DNS records at scale

Feed a subdomain list and let tko-subs resolve each name and match it against the provider CSV, flagging the records that point at deprovisioned services.

Confirm a takeover by claiming the resource

Supply provider credentials and set the -takeover flag to claim a dangling resource, proving the finding rather than leaving it theoretical.

Tune resolution for wide scopes

Point queries at a specific DNS server with -server and raise -threads so a large host list resolves quickly without overwhelming a single resolver.

Extend provider coverage

Edit the CMS providers CSV passed via -data to add fingerprints for services the default set misses, keeping detection current as platforms change their error pages.

reference

tko-subs inputs and flags

11 inputs
NameTypeFlagDescription
domainsFILE-domainsList of domains to check.
domainSTRING-domainDomains to check, separated by commas.
serverSTRING-serverDNS server to direct queries to (default 8.8.8.8).
threadsSTRING-threadsNumber of threads to run in parallel (default 5).
takeoverBOOLEAN-takeoverTake over a vulnerable domain rather than only detecting it.
cms-providers-csvFILE-dataCSV of CMS provider strings used for identification.
github-tokenSTRING-githubtokenGitHub personal access token for claiming GitHub Pages records.
heroku-api-keySTRING-herokuapikeyHeroku API key for claiming Heroku records.

Showing key inputs. tko-subs exposes 11 inputs in total.

Full flag reference (11 inputs)
NameTypeFlagDescription
portSTRING-portThe DNS server port (you shouldn't have to change this) (default: "53").
domainSTRING-domainDomains separated by ",".
serverSTRING-serverA DNS server to direct queries to (default: "8.8.8.8").
domainsFILE-domainsList of domains to check
threadsSTRING-threadsNumber of threads to run parallel (default: 5).
takeoverBOOLEAN-takeoverFlag to denote if a vulnerable domain needs to be taken over or not (default: false).
github-tokenSTRING-githubtokenGithub personal access token.
heroku-api-keySTRING-herokuapikeyHeroku API key.
heroku-app-nameSTRING-herokuappnameHeroku app name.
heroku-usernameSTRING-herokuusernameHeroku username.
cms-providers-csvFILE-dataCSV file containing CMS providers' string for identification (default: "providers-data.csv").

example

Run tko-subs

tko-subs · command
# detect dangling DNS records across a subdomain listtko-subs -domains subdomains.txt -data providers-data.csv -server 8.8.8.8 -threads 10
sample output
cdn.example.com [CNAME] github.com - VULNERABLEassets.example.com [CNAME] s3.amazonaws.com - VULNERABLEapi.example.com [CNAME] app.example.net - NOT VULNERABLEapp.example.com [A] 198.51.100.10 - NOT VULNERABLEstaging.example.com [CNAME] pages.github.com - VULNERABLEdev.example.com [A] 203.0.113.20 - NOT VULNERABLEwww.example.com [A] 192.0.2.15 - NOT VULNERABLE

guidance

Choosing tko-subs

Use tko-subs when you need dangling-DNS detection and optional reclaim. Match against an editable -data CSV; claim GitHub or Heroku with credentials. For fingerprint-only can-i-take-over-xyz checks, prefer subzy.

subzy

Detection only via can-i-take-over-xyz fingerprints. Quicker pass; tko-subs can also claim the resource.

subfinder

Finds the subdomains to check. Run it before tko-subs to produce the domain list.

nuclei

Has takeover templates among many other checks. tko-subs is purpose-built and can perform the takeover.

faq

tko-subs questions

It resolves each subdomain and matches the answer against the -data CSV of CMS provider fingerprints, flagging records that point at deprovisioned, claimable services.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run tko-subs yourself

A subdomain list feeds tko-subs, which resolves each name, flags the dangling records, and writes the takeover candidates as an output.

Open tko-subs in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.