Subdomain Takeover Detection

The Subdomain Takeover module is a layered scanner that finds dangling DNS records whose third-party target can still be claimed by an attacker (expired Heroku apps, decommissioned S3 buckets, dead GitHub Pages, orphaned NS delegations, etc.). It stacks three independent detection engines, deduplicates their output, scores each finding against a confidence model, and emits Vulnerability nodes with source="takeover_scan".

It runs as GROUP 6 Phase A (parallel with Nuclei and the GraphQL scanner). Disabled by default. Enable in the project settings under the Subdomain Takeover tab.

Why a layered scanner

No single tool catches every takeover class. The module combines three engines with different strengths so coverage compounds:

Findings from all three engines are merged on (hostname, provider, method), so a subdomain confirmed by two engines produces one finding with both tools listed under sources and a confidence bonus.

Pipeline position

GROUP 5  - Resource enumeration (Katana, Hakrawler, jsluice, FFuf, GAU, Kiterunner, Arjun)
GROUP 5b - JS Reconnaissance
GROUP 6 Phase A  - Nuclei  ||  GraphQL Security  ||  Subdomain Takeover     <- parallel fan-out
GROUP 6 Phase B  - MITRE enrichment (consumes Nuclei CVEs)

Phase A tools are launched via ThreadPoolExecutor. Each scanner uses an _isolated wrapper that deep-copies the shared combined_result so the three threads never race on the same dict. The module pulls its inputs from GROUP 1 (DNS subdomains) and GROUP 4 (httpx alive URLs), so it needs the DNS + HTTP probe stages to have already completed.

Target collection

The module assembles two target sets from combined_result:

Dead hosts are Subjack and BadDNS territory (CNAME/NS walks do not need a live HTTP response). Alive URLs get the HTTP-fingerprint treatment via Nuclei.

Subjack layer (DNS-first, primary)

Subjack (haccer/subjack, Apache-2.0) is a Go tool that walks CNAME/NS/MX records, checks the resulting hostname against a compiled-in fingerprint database, and reports vulnerable subdomains. The binary is built in Stage 1d of the recon Dockerfile and installed at /usr/local/bin/subjack.

Command shape:

subjack -w <targets.txt> -t <threads> -timeout <sec> -o <results.json> \
        [-ssl] [-a] [-ns] [-ar] [-mail] [-r <resolvers>]

Flags:

Subjack has no -c flag; fingerprints are compiled into the binary. A vulnerable row in subjack_results.json is normalized into the canonical finding shape with source_tool="subjack".

Run bound: SUBJACK_RUN_TIMEOUT (default 900 s) hard-caps the whole subjack invocation so a pathological target set cannot stall the pipeline.

Nuclei takeover templates (fingerprint-based)

The module reuses the existing Nuclei Docker image but forces -t http/takeovers/ -t dns/ so only ~60 takeover-focused templates fire instead of the full 9,000+ community set. Targets are the alive URLs collected above.

Key differences vs. the main Nuclei vuln scan:

Only findings whose tags or template-id include takeover, dangling, or detect-dangling-cname are kept; other categories (CVE, misconfig) are discarded by the normalizer. HTTP templates map to method="cname", DNS templates map to method="dns". The first extracted_results entry becomes cname_target.

BadDNS layer (AGPL-3.0 isolated sidecar)

BadDNS is an AGPL-3.0 Python toolkit that goes well beyond CNAME walks: it audits NS, MX, SPF, DMARC, wildcard, NSEC zone-walking, zone transfers, and HTML references. Because of the AGPL-3.0 license, RedAmon never imports baddns at the Python level. Instead a dedicated Docker image (redamon-baddns:latest) ships upstream baddns unmodified, and the recon container spawns it via Docker-in-Docker. The process + filesystem boundary is the license-safe integration pattern (see THIRD-PARTY-LICENSES.md).

Build the sidecar once:

docker compose --profile tools build baddns-scanner

The image is not pulled automatically. If it is missing on the host, the BadDNS layer is skipped with a warning instead of aborting the run.

Container invocation:

docker run --rm --name redamon-baddns-<pid>-<ts> \
    -v <work_dir_host>:/work:ro \
    redamon-baddns:latest \
    /work/baddns_targets.txt \
    <modules_csv> \
    <nameservers_csv>

The entrypoint is a batch wrapper that invokes baddns -s -m <modules> -- <target> once per line, with a per-target timeout (BADDNS_PER_TARGET_TIMEOUT, default 90 s) so one hanging target cannot stall the batch. Findings arrive as NDJSON on stdout, one JSON object per line from Finding.to_json().

BadDNS modules

BadDNS ships 11 modules; 10 are CLI-addressable (MTA-STS is excluded because the baddns 2.1.0 validate_modules regex rejects the hyphen). RedAmon exposes all 10 in the UI.

Default enabled subset: cname, ns, mx, txt, spf. nsec and zonetransfer are opt-in because they can be slow on large targets. Unknown module strings are silently filtered at command-build time to prevent argparse-level baddns failures.

Nameservers: BADDNS_NAMESERVERS is an optional comma-separated resolver list passed to baddns via -n. Empty = system resolvers.

Provider fingerprinting

Each normalized finding is tagged with a canonical takeover_provider slug (e.g. github-pages, heroku, aws-s3). The provider is inferred in this precedence order:

1. Subjack service field (e.g. "GitHub" -> github-pages)
2. Nuclei template-id substring (e.g. heroku-takeover -> heroku)
3. BadDNS signature or indicator strings
4. Fallback CNAME resolution against the DNS map (e.g. foo.herokuapp.com -> heroku)
5. BadDNS module name as last resort (e.g. ns -> ns) for otherwise-unknown matches

Auto-exploitable providers (single-step claim, no verification challenge) receive a +20 confidence bonus:

github-pages, heroku, aws-s3, shopify, fastly, ghost,
unbounce, readthedocs, surge, webflow, tumblr, statuspage

The full fingerprint table (~40 signals + ~30 CNAME patterns) lives in recon/helpers/takeover_helpers.py::PROVIDER_FROM_SIGNAL. Keep it in sync with upstream nuclei-templates/http/takeovers/ and subjack fingerprints when adding providers.

Deduplication & scoring

Dedupe key

Findings are merged by the tuple (hostname, takeover_provider, takeover_method). Merged findings carry:

• sources: ordered list of tool names (subjack, nuclei_takeover, baddns)
• confirmation_count: len(sources)
• raw_by_source: {tool: raw_payload} for provenance
• evidence: Subjack evidence is kept when both Subjack and another tool fire (higher precision)

Confidence scoring

Every deduped finding is scored 0-100 using additive rules:

Score is clamped to [0, 100], then mapped to a verdict:

Default threshold is 60, configurable via TAKEOVER_CONFIDENCE_THRESHOLD.

Severity mapping

manual_review defaults to info so it does not pollute the main alert stream. Flip TAKEOVER_MANUAL_REVIEW_AUTO_PUBLISH on when you want every unverified candidate surfaced in the findings table.

Full parameter reference

Master toggle

Subjack

Nuclei takeover templates

The following nuclei settings are inherited from the global Nuclei block: NUCLEI_BULK_SIZE, NUCLEI_CONCURRENCY, NUCLEI_TIMEOUT, NUCLEI_RETRIES, NUCLEI_SYSTEM_RESOLVERS, NUCLEI_FOLLOW_REDIRECTS, NUCLEI_MAX_REDIRECTS. Global NUCLEI_EXCLUDE_TAGS is not inherited (would accidentally exclude takeover tags).

Scoring & severity

BadDNS sidecar

Output structure

Results live under combined_result.subdomain_takeover:

{
  "findings": [
    {
      "id": "takeover_9d2e4b1a3f8c",
      "hostname": "promo.example.com",
      "cname_target": "promo-app.herokuapp.com",
      "takeover_provider": "heroku",
      "takeover_method": "cname",
      "evidence": "Subjack confirmed Heroku takeover",
      "severity": "high",
      "confidence": 85,
      "verdict": "confirmed",
      "sources": ["subjack", "nuclei_takeover"],
      "confirmation_count": 2,
      "raw_by_source": { "subjack": {...}, "nuclei_takeover": {...} },
      "detected_at": "2026-04-21T13:37:00Z"
    }
  ],
  "by_target": { "promo.example.com": [ {...} ] },
  "summary": {
    "total": 3,
    "confirmed": 1,
    "likely": 1,
    "manual_review": 1,
    "by_provider": { "heroku": 1, "aws-s3": 1, "unknown": 1 }
  },
  "scan_metadata": {
    "subjack_enabled": true,
    "nuclei_takeovers_enabled": true,
    "confidence_threshold": 60,
    "subdomains_scanned": 42,
    "alive_urls_scanned": 37,
    "duration_sec": 128.4,
    "scan_timestamp": "2026-04-21T13:37:00Z"
  }
}

id is a deterministic SHA1-based hash of hostname|provider|method so rescans update the same graph node instead of duplicating.

Graph schema

Input nodes (consumed)

The scanner never queries Neo4j directly during the full recon run -- all inputs come from the in-memory combined_result dict that earlier pipeline stages populated. The underlying graph provenance of those inputs is:

In Partial Recon, the scanner instead calls _build_vuln_scan_data_from_graph() which directly reads Subdomain, DNSRecord, and BaseURL nodes out of Neo4j for the project, plus any user-supplied subdomains injected by the modal.

Nodes that are not read: IP, Port, Service, Endpoint, Technology, Parameter, Header, Certificate, CVE, ExternalDomain, MitreData, Capec, Secret.

Output nodes (produced)

Nodes that are not produced or modified: Domain, IP, Port, Service, Endpoint, BaseURL, DNSRecord, Technology, Parameter, Header, Certificate, CVE, MitreData, Capec, Secret, ExternalDomain. The takeover module is deliberately narrow: it writes one node type plus at most one relationship per finding.

Anchor attachment precedence

For every finding, the mixin tries three anchor strategies in order and stops on the first that succeeds:

1. Match existing Subdomain with {name: hostname, user_id, project_id} and MERGE the HAS_VULNERABILITY edge to it.
2. Match existing Domain (only if the hostname equals the project apex) and MERGE the edge to it instead. This handles takeovers on the bare apex that do not have a matching Subdomain node.
3. Create a defensive Subdomain with source="takeover_scan" and attach the Vulnerability to it. This mirrors how the main Nuclei vuln mixin handles orphan findings and guarantees every Vulnerability is reachable from the graph page.

Properties written on each Vulnerability

Rules of Engagement

Subdomain Takeover inherits the project-level RoE applied during GROUP 1 (subdomain discovery) and GROUP 4 (HTTP probe). Targets already filtered by ROE_EXCLUDED_HOSTS never reach the takeover module because the input lists come straight from dns.subdomains and http_probe.by_url.

Stealth mode

When stealth mode is enabled on the project, the takeover module is toned down:

Subjack in DNS-only mode stays on: CNAME/NS/MX resolution does not generate HTTP traffic to the target and is safe at low concurrency. The HTTP-fingerprint Nuclei layer and the BadDNS sidecar are disabled outright.

Partial recon

Subdomain Takeover is available as a Partial Recon tool (tool_id="SubdomainTakeover"). The modal accepts user-provided custom subdomains that must be within the project scope (the entry must equal the apex or end with .<apex>). Out-of-scope entries are rejected with a log warning.

Partial-recon run behaviour:

• SUBDOMAIN_TAKEOVER_ENABLED is force-set to true for the run, overriding the project toggle.
• settings_overrides from the modal bypass stored project settings for that run.
• User subdomains are resolved via the system resolver; dangling entries (no A/AAAA) are still scanned because they are the prime takeover candidates.
• Graph-existing targets can be included or excluded via the "Include existing graph targets" checkbox. When both are empty, the run exits with a "no subdomains to scan" message.
• Confirmed findings are written to the graph as if the full pipeline ran, so repeated partial runs converge on the same Vulnerability.id instead of duplicating.

See Recon Pipeline Workflow -- Partial Recon for the modal layout.

Implementation notes

• Subjack install path: baked into the recon image as a pure-Go binary from github.com/haccer/subjack (built with Go 1.25 in a separate Docker stage). Upstream has no release tarball, so the image pins @latest at build time.
• BadDNS upstream version: pinned to baddns==2.1.0. Bump in scanners/baddns_scan/Dockerfile only after verifying the normalizer in recon/helpers/takeover_helpers.py::normalize_baddns_finding still matches the Finding JSON schema.
• Shared work directory: the runner uses /tmp/redamon/redamon_takeover_*/ which is bind-mounted between the recon container and the host, so Docker-in-Docker siblings (nuclei, baddns) see the same paths. The directory is chmod 755 so the non-root baddns user in the sidecar can read target files.
• Orphan container reaping: the baddns invocation passes --name redamon-baddns-<pid>-<ts> so a Python TimeoutExpired can docker kill the named container instead of leaving a daemon-owned orphan.
• Never --amend: rescans produce the same finding_id by design, so MERGE (v:Vulnerability {id: $id}) in the mixin updates in place (first_seen sticks, last_seen moves).

Related pages

• Project Settings Reference -- Subdomain Takeover -- full parameter tables
• Recon Pipeline Workflow -- pipeline diagram
• AI in the Recon Pipeline -- the takeover AI classifier that separates real unclaimed pages from WAF block pages
• Running Reconnaissance -- execution model
• GraphQL Security Testing -- sibling GROUP 6 Phase A scanner
• Rules of Engagement -- host exclusion rules applied before probes fire