Massive subdomain takeover discovery using dnsx and subzy.
As part of responsible disclosure research, a large-scale subdomain enumeration exercise revealed more than 2000 subdomains belonging to the target organization.
Further reconnaissance identified multiple Heroku-hosted subdomains vulnerable to takeover due to dangling DNS configurations.
Reconnaissance
Initial enumeration focused on collecting CNAME records across the target's attack surface.
The following tooling was used:
- dnsx
- subzy
- curl
- awk
- bash automation
Target Enumeration
The target organization exposed more than 2000 subdomains.
dnsx from ProjectDiscovery was used to collect DNS records and identify third-party providers.
Analysis revealed that more than 20 subdomains pointed towards Heroku infrastructure.
Filtering Heroku Subdomains
The initial output required filtering to extract the Heroku-related targets.
cat vuln-subs.txt | awk '{print $2}'
The resulting output isolated candidate takeover targets.
Cleanup Processing
Additional processing removed unwanted brackets and formatting artifacts.
cat vuln-subs.txt | awk '{print $2}' \
| awk '{print substr($0,2,length()-2);}'
Automated Validation
The cleaned list was passed into subzy for automated subdomain takeover detection.
subzy run --targets vuln-heroku-subs.txt
Not all identified subdomains were vulnerable.
Only Heroku endpoints without active deployments were susceptible to takeover.
Verification
Further validation was performed using curl to inspect HTTP response behavior.
for i in `cat vuln-heroku-subs.txt`;
do
echo $i;
curl --head $i;
done;
Subdomains returning HTTP 404 responses were confirmed as dangling targets vulnerable to takeover.
Root Cause
- Dangling CNAME records
- Orphaned Heroku applications
- Improper DNS lifecycle management
- Missing infrastructure cleanup
Impact
Successful subdomain takeover may allow attackers to:
- Host attacker-controlled content
- Steal session cookies
- Launch phishing campaigns
- Bypass origin trust assumptions
- Abuse trusted subdomains
- Compromise user trust
Responsible Disclosure
A full proof-of-concept demonstrating the takeover conditions was created and responsibly disclosed to the affected organization.
Tools Used
- dnsx
- subzy
- awk
- curl
- bash scripting
Conclusion
Large-scale cloud infrastructure combined with weak DNS lifecycle management often creates opportunities for subdomain takeover vulnerabilities.
Automated enumeration and validation tooling can quickly identify exposed cloud assets and dangling records across large attack surfaces.
Thank you for reading.