Subjack

Subjack is designed to detect subdomain takeovers by scanning subdomains for vulnerable CNAME records that point to services no longer controlled by the domain owner. This tool is particularly useful in reconnaissance phases of security assessments, allowing testers to identify potential hijacking opportunities across large lists of subdomains quickly.

With its concurrent scanning capabilities powered by Go, Subjack excels in mass-testing scenarios where speed and efficiency are critical. It stands out for handling high volumes of subdomains without significant performance degradation, making it ideal for bug bounty hunters and penetration testers targeting expansive domain infrastructures.

Users should always manually verify results to eliminate false positives, as automated detection may occasionally flag benign configurations. Additionally, Subjack checks for subdomains associated with NXDOMAIN responses, flagging domains that do not exist and could potentially be registered for takeover.

Subjack operates by concurrently querying DNS records for a list of subdomains, focusing on CNAME entries that match known vulnerable fingerprints loaded from a JSON configuration file. It sends requests primarily to URLs with identified CNAMEs (unless -a is used) and checks against a database of takeover signatures for services like unclaimed AWS S3 buckets or GitHub pages. The tool flags valid CNAMEs pointing to dead or hijackable endpoints and handles NXDOMAIN cases for registrable domains.