BadDNS
Check subdomains for subdomain takeovers and other DNS tomfoolery
BadDNS is a standalone tool and BBOT module for detecting domain/subdomain takeovers of all kinds, including other DNS issues like NSEC walks and Subdomain Takeovers.
Check out the introductory blog on the BLS substack!
Installation
We have a pypi package, so you can just do pip install baddns to make use of the library.
Or use pipx: pipx install git+https://github.com/blacklanternsecurity/baddns
Usage
After installing with pip, you can just run baddns from the command line.
usage: baddns [-h] [-n CUSTOM_NAMESERVERS] [-c CUSTOM_SIGNATURES] [-l] [-s] [-m MODULES] [-d] [-D] [target]
Check subdomains for subdomain takeovers and other DNS tomfoolery
positional arguments:
target subdomain to analyze
options:
-h, --help show this help message and exit
-n CUSTOM_NAMESERVERS, --custom-nameservers CUSTOM_NAMESERVERS
Provide a list of custom nameservers separated by comma.
-c CUSTOM_SIGNATURES, --custom-signatures CUSTOM_SIGNATURES
Use an alternate directory for loading signatures
-l, --list-modules List available modules and their descriptions.
-s, --silent Only show results, no other output (JSON format)
-m MODULES, --modules MODULES
Comma separated list of module names to use. Ex: module1,module2,module3
-d, --debug Enable debug logging
-D, --direct Enable direct mode
Modules
| Name | Description |
|---|---|
| cname | Check for dangling CNAME records and interrogate them for subdomain takeover opportunities |
| ns | Check for dangling NS records, and interrogate them for takeover opportunities |
| mx | Check for dangling MX records and assess their base domains for availability |
| nsec | Enumerate subdomains by NSEC-walking |
| references | Check HTML content for links or other references that contain a hijackable domain |
| txt | Check TXT record contents for hijackable domains |
| zonetransfer | Attempt a DNS zone transfer |
| dmarc | Check for missing or misconfigured DMARC records |
| mta-sts | Check for MTA-STS misconfigurations and dangling mta-sts subdomains |
| wildcard | Check for wildcard DNS records that could enable domain-wide subdomain takeover |
| spf | Check for missing or misconfigured SPF records and hijackable include/redirect domains |
Examples
- Simple check
baddns subdomaintocheck.example.com
- Specify Module(s)
baddns -m CNAME subdomaintocheck.example.com
baddns -m CNAME,NS subdomaintocheck.example.com
- List available Modules
baddns -l
- Custom Nameservers
baddns -n 1.1.1.1 subdomaintocheck.example.com
Documentation
Please visit our full documentation for many more details, including information about specific BadDNS modules.
Acknowledgements
BadDNS Signatures are sourced primarily from Nuclei Templates and from dnsReaper by Punk Security, although many have been modified or updated in BadDNS. Much of the research contained in the signatures was originally discussed on the issues page of can-i-take-over-xyz.
1 maintainer
Metadata
1 maintainer
Release files for baddns 2.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| baddns-2.5.0.tar.gz | 80.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| baddns-2.5.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 214.5 kB
Release files / baddns-2.5.0.tar.gz
| Download URL | baddns-2.5.0.tar.gz |
|---|---|
| Size | 80.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8f2f87dc2be54a5a74aea350cf4b079fcafbe31b811951ac940952ad29c2e96a
|
|
BLAKE2b-256 checksum How to use checksums |
07382adf163056db50f943a838fb3602463762fc523d3f6a9147fd0a2bea631f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / baddns-2.5.0-py3-none-any.whl
| Download URL | baddns-2.5.0-py3-none-any.whl |
|---|---|
| Size | 134.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b8d6d04f75cb47cf261c21708ea41ec89111b447844e458337604a702b717b5a
|
|
BLAKE2b-256 checksum How to use checksums |
165a1e0479d06fcb17e8310383b58be8c4aad5e17f8d781b9ed785b70b6eed3f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
