Scan for Subdomain Takeover Vulnerabilities
Check dangling DNS records that point to unprovisioned cloud services so an attacker cannot claim the CNAME and host content on your subdomain.
Task
Implement npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} to close a known attack surface before the next security review finds it.
When to use this
A penetration test report flags the missing npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} as a medium-severity finding on a public endpoint.
Prerequisites
- A running application with the vulnerable endpoint
- Access to security headers or middleware config
Steps
1. Configure npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} in the project configuration file with the recommended defaults.
npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {}
Expected output: The configuration is accepted and npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} runs without errors on the first invocation.
2. Run the check locally to verify npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} blocks merge on failure.
- name: Run add subdomain takeover scan
run: pnpm test
Expected output: Pull requests with failing npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Close the attack surface
Start by measuring the problem. Check dangling DNS records that point to unprovisioned cloud services so an attacker cannot claim the CNAME and host content on your subdomain. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} against the current codebase and inspect the output before wiring it into CI.
npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {}Verify and monitor
Once the gate is in place, make failures actionable. A failing npx subfinder -d example.com | xargs -I{} npx nuclei -t takeover -u {} should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.