subdomain takeover (stealing websites)

About this video

The creator explains subdomain takeover using his example domain hackwellindustries.com. Subdomains like code. and azure. often point via CNAME records to third-party services such as GitHub or Microsoft Azure. The vulnerability occurs when an admin deletes the third-party account or resource but leaves the DNS CNAME in place. An attacker can then register a new account/resource with the same released name, and the victim’s subdomain now serves attacker-controlled content — enabling convincing phishing on a legitimate company domain. He demonstrates discovery with Amass to enumerate subdomains and a tool called ’takeover’ to flag vulnerable ones, then uses dig to see the CNAME target. For GitHub he walks through creating a username.github.io repository, adding an index file and a CNAME file for the target subdomain, and confirming via GitHub Pages settings; he notes GitHub sometimes holds deleted usernames for 90 days, though in a follow-up test a name became available immediately. For Azure he creates a VM in the matching region (Central US) and claims the available DNS label. Defense is auditing DNS and removing stale entries. He frames the technique as educational and useful to check for in bug bounty work.

Key takeaways

• A dangling CNAME to a deleted GitHub, Azure, S3 or similar resource lets anyone who re-registers that name control the subdomain
• Discovery workflow shown: enumerate subdomains with Amass, screen them with the takeover tool, and inspect CNAME targets with dig
• GitHub takeover steps: create the account, publish a username.github.io repo, and add a CNAME file pointing at the victim subdomain
• Azure takeover steps: create a resource in the same region and claim the released DNS label so it matches the existing record
• Prevention is DNS hygiene — regularly audit records and delete any entry whose underlying service no longer exists

Episode details: published November 14, 2022 · 8:37 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: Block ALL ads with this…(and speed up your internet) · Next: 60 Linux Commands you NEED to know (in 10 minutes) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube