TakeOver : Sub-Domain TakeOver Vulnerability Scanner

Sub-domain TakeOver vulnerability occur when a sub-domain (subdomain.example.com) is pointing to a service (e.g: GitHub, AWS/S3,..) that has been removed or deleted.

This allows an attacker to set up a page on the service that was being used and point their page to that sub-domain. For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com.

Also Read – OpenSK : Open-Source Implementation For Security Keys

Supported Services

‘AWS/S3’
‘BitBucket’
‘CloudFront’
‘Github’
‘Shopify’
‘Desk’
‘Fastly’
‘FeedPress’
‘Ghost’
‘Heroku’
‘Pantheon’
‘Tumbler’
‘WordPress’
‘Desk’
‘ZenDesk’
‘TeamWork’
‘Helpjuice’
‘Helpscout’
‘S3Bucket’
‘Cargo’
‘StatuPage’
‘Uservoice’
‘Surge’
‘Intercom’
‘Webflow’
‘Kajabi’
‘Thinkific’
‘Tave’
‘Wishpond’
‘Aftership’
‘Aha’
‘Tictail’
‘Brightcove’
‘Bigcartel’
‘ActiveCampaign’
‘Campaignmonitor’
‘Acquia’
‘Proposify’
‘Simplebooklet’
‘GetResponse’
‘Vend’
‘Jetbrains’
‘Unbounce’
‘Tictail’
‘Smartling’
‘Pingdom’
‘Tilda’
‘Surveygizmo’
‘Mashery’

Installation

git clone https://github.com/m4ll0k/takeover.git
cd takeover
python3 setup.py install

or:

wget -q https://raw.githubusercontent.com/m4ll0k/takeover/master/takeover.py && python3 takeover.py

Usage

$ python3 takeover.py -d www.domain.com -v
$ python3 takeover.py -d www.domain.com -v -t 30
$ python3 takeover.py -d www.domain.com -p http://127.0.0.1:8080 -v
$ python3 takeover.py -d www.domain.com -o or -v
$ python3 takeover.py -l uber-sub-domains.txt -o output.txt -p http://xxx.xxx.xxx.xxx:8080 -v
$ python3 takeover.py -d uber-sub-domains.txt -o output.txt -T 3 -v

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

2 weeks ago