Mastering Subdomain Takeovers

Here’s how I got bounties through subdomain takeovers -

Subdomain takeovers are vulnerabilities that occur when a subdomain (part of a larger website, like mail.example.com) is no longer actively used by the intended owner. This can happen due to various reasons, such as:

Looks like your DNS settings got a little too friendly with mine.

Steps to get $ -

Step 1: Begin by selecting your target domain and initiating the process of identifying potential subdomains. Utilize tools like Subfinder, combined with the ‘-sc 404’ flag, to pinpoint unclaimed subdomains, which are crucial for potential takeover attempts. The initial command to execute is:

Step 2: Proceed to manually inspect each subdomain flagged with a 404 response code. Pay close attention to any clues or information provided, especially indications of unclaimed S3 buckets or other relevant details. Additionally, use the ‘dig’ command to investigate the CNAME (Canonical Name) records. For instance, utilizing dig command enables the retrieval of the CNAME, revealing where the original subdomain directs to. This step is important in a successful domain takeover.

Step 3: Now check this GitHub repo Can I Take Over XYZ there is a table in it which shows the list of vulnerable cname you can verify whether your cname is vulnerable or not.

Another simple way is to use Nuclie. It has a template called “takeover” which helps you see if a domain can be taken over. But remember, it’s a good idea to double-check manually sometimes because automated tools can make mistakes. To use Nuclie, just type in the command:

Nuclei Template1, Nuclei Template2

If there’s a possibility of takeover, explore different strategies to achieve it. I’ll describe several methods for you to consider.

Keep in mind that the report you submit is crucial for bug bounty programs, so it’s essential to know the right words to use to maximize your chances of receiving good bounties.

Steal a website? Not quite, but close!

Case I — .cloudapp.net

Step 1: Navigate to the Azure portal.

Step 2: Select “Cloud Services (classic)” from the menu.

Step 3: Create a new cloud service by clicking on the “Add” button.

Step 4: Fill in the necessary details such as service name, subscription, resource group, and location.

Step 5: Choose the appropriate configuration options and deployment model.

Case II — .azurewebsites.net

Step 1: Access the Azure portal.

Step 2: Navigate to “App Services.”

Step 3: Click on “Create New Web App.”

Step 4: Provide the necessary details such as name, subscription, resource group, and region. Ensure that the name matches the existing one if you want to replace it.

Step 5: Once the web app is created, navigate to its dashboard.

Step 6: Access the deployment options and choose the deployment method you prefer, such as FTP, Git, or Azure Pipelines.

Step 7: Upload or connect your deployment package and initiate the deployment process.

There are numerous methods for claiming a subdomain and potentially earning a generous bounty. One suggestion is to explore alternative CNAME records by searching for them on Google or in previous reports, as they may reveal valuable information.