← LibraryTechnique entry
W-SUBDOMAIN-TAKEOVERInitial Access
Subdomain Takeover
Dangling CNAME pointing to an unclaimed cloud resource (S3, Azure, Heroku) — claim it and serve attacker content under the trusted host.
§ Where this technique fits
W-SUBDOMAIN-TAKEOVER is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 2 approved dossiers in the registry, typically at step 2 on average.
§ Dossiers chaining this technique
- step 2 / 6
Subdomain takeover → ACME DNS-01 → trusted cert for victim host
Find a dangling CNAME / NS record. Claim the underlying resource; complete Let's Encrypt's DNS-01 challenge for the parent hostname. Now have a publicly-trusted cert for victim.example.com — chain into AITM.
- step 2 / 7
Subdomain takeover → cookie theft → account takeover
Dangling CNAME on a corporate subdomain (e.g. mail.target.com → unclaimed Heroku app). Claim it, serve a malicious page, harvest session cookies scoped to *.target.com.
§ What commonly comes next
- 01ACME DNS-01 Validation Hijackseen 1×PKI-ACME-DNS01 · Initial Access
- 02Open Redirectseen 1×W-OPEN-REDIRECT · Initial Access