---
title: "Subdomain Takeover/ Hijacking vulnerability"
canonical: "https://kb.cynergy.app/space/MD/899416125/Subdomain%20Takeover%2F%20Hijacking%20vulnerability"
format: markdown
---
**Description**

A subdomain takeover occurs when an attacker gains control over a subdomain of a target domain. Typically, this happens when the subdomain has a canonical name (CNAME) in the Domain Name System (DNS), but no host is providing content for it. This can happen because either a virtual host hasn't been published yet or a virtual host has been removed. An attacker can take over that subdomain by providing their own virtual host and then hosting their own content for it.

A subdomain is like an electrical outlet. If you have your own appliance (host) plugged into it, everything is fine. However, if you remove your appliance from the outlet (or haven't plugged one in yet), someone can plug in a different one. You must cut power at the breaker or fuse box (DNS) to prevent the outlet from being used by someone else.

**Hacker's View**

As a hacker, I can run scanners to detect misconfigured Subdomains using tools like “dig” and [Subjack](https://github.com/haccer/subjack).

once I have successfully hijacked a subdomain, I can use it for Phishing infrastructure by providing my own content and serving it to users, under the main domain. 

I can also read cookies set from the main domain, perform cross-site scripting, or circumvent content security policies, thereby enabling me to capture protected information (including logins) or send malicious content to unsuspecting users.

**Mitigation**

Remove the affected DNS record — If the affected source domain name is no longer needed remove the affected record from the DNS zone.

Claim the domain name and repurchase the expired domain.

**Cynergy’s View**

You can use Cynergy’s automated subdomain takeover capability to mitigate the issue, by pressing on the asset and “Take Over” button, this will trigger a process where Cynergy registers the asset to which the DNS points and will prevent any misuse of the vulnerability. This way it prevents the hacker from hijacking/ taking over the subdomain.

The button can be found in the configuration of each asset. 

![image](media://92297c7d-f36c-44f6-97b0-6162628ae2b0)


![image](media://3aff5e13-9b68-4f6d-8501-568d3c0f9a76)

This would lead to a modification of the DNS resource that the DNS entry was pointing to an image file.





**Reference**

HackerOne- [https://www.hackerone.com/application-security/guide-subdomain-takeovers](https://www.hackerone.com/application-security/guide-subdomain-takeovers)  

Patrick Hudak- [https://0xpatrik.com/subdomain-takeover-basics/](https://0xpatrik.com/subdomain-takeover-basics/)