PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Guide To Subdomain Takeovers

hackerone.com | blog | #bug-bounty | #reconnaissance | #vulnerability | #guide | #subdomain-takeover | #dns
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

EdOverflow's guide to subdomain takeovers: dangling DNS records pointing to unclaimed third-party services like GitHub Pages let attackers claim a vulnerable subdomain and serve their own content.
Published
Collected

Related coverage

blog · netspi.com
10 Techniques for Blindly Mapping Internal Networks
Catalogs ten blind internal network discovery techniques: DHCP info, traffic sniffing, ARP broadcasts, net view, DNS zone transfers, domain accounts, traceroute, and ping or port scans.
research · hackerone.com
A Guide To Subdomain Takeovers 2.0
An updated guide to subdomain takeovers: how dangling DNS records pointing to third-party services let attackers claim control, with enumeration, exploitation, and reporting best practices.
vulnerability · projectdiscovery.io
Introducing Neo Triage
On October 26, 2026 we're releasing Neo Triage, an autonomous engine for vulnerability triage. While other tools rank your backlog, Neo clears it.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
blog · bishopfox.com
How We Can Stop Email Spoofing
Bishop Fox scanned the Alexa top million domains and found 98% vulnerable to email spoofing; only 2% combined SPF with strict DKIM. The free SpoofCheck tool diagnoses missing defenses.
blog · bishopfox.com
Fishing the AWS IP Pool for Dangling Domains
How recycled AWS IPs create dangling-domain risks: after allocating an Elastic IP and searching Bing's ip: operator, Matt Bryant found forgotten DNS records still pointing at it.
Back