Subdomain Takeover Tools

A set of tools to validate the initial outcome of subtake.

Installation

Install using pip:

pip install subdomain_takeover_tools

for windows:

py -m pip install subdomain_takeover_tools

Alternatively, you can download or clone this repo and call pip install -e ..

Confirming takeovers

All scripts support the following two parameters:

--strict: only report as vulnerable if the issue is not also applicable on hostname.tld and www.hostname.tld.
--inverse: do inverse reporting, so report all subdomains that are not vulnerable

Supported input formats

In addition to plain hostnames, the scripts accept the output of two scanners and auto-detect which one is used per line:

subtake: [service: target]<tab><tab>domain
nuclei takeover templates: [template-id] [protocol] [severity] url ["extracted-cname"]

For the unified confirm_takeover dispatcher, nuclei template ids such as github-takeover and aws-bucket-takeover are mapped to the matching service validator automatically. Findings for services without a validator are considered unsupported and dropped by default. The dispatcher accepts two extra parameters:

--full: output the full input line instead of just the domain.
--include-unsupported: also emit unsupported findings (services with no validator), so a single pass over nuclei output keeps both confirmed-vulnerable and not-yet-disproven findings.

Some scripts require a config file to be present, the location is .subdomain_takeover_tools.ini, an example of the file can be found below:

[azure]
subscription_id=44713cf2-8656-11ec-a8a3-0242ac120002
[github]
username=martinvw
access_token=44713cf2-8656-11ec-a8a3-0242ac120002
repo=44713cf2-8656-11ec-a8a3-0242ac120002
[fastly]
api_token=44713cf2-8656-11ec-a8a3-0242ac120002
service=44713cf2-8656-11ec-a8a3-0242ac120002
version=3

Confirming S3

Subtake has some false positives on Google Cloud buckets as S3 buckets, also some access denied's end up in the results.

The script confirm-s3.py will make sure that the bucket is actually vulnerable.

grep "\[s3 bucket: " subtake-output.txt | confirm_s3

Confirming ELB

Some patterns of elb are vulnerable while others are not, to filter them we can use our script:

grep "\[elasticbeanstalk: " subtake-output.txt | confirm_elb

Note: the parameter --strict is accepted here but will not lead to expected results.

Please note that some regions are not enabled by default, when you receive the following error:

botocore.exceptions.ClientError: An error occurred (InvalidClientTokenId) when calling the CheckDNSAvailability operation: The security token included in the request is invalid.

This could mean you have not yet enabled these, opt-in, regions, see https://console.aws.amazon.com/billing/home?#/account

Confirming Shopify

It seems that all current shopify examples are vulnerable, the following check just validates the DNS.

grep "\[shopify: " subtake-output.txt | confirm_shopify

Filtering Pantheon

Please note that for pantheon this repo currently only provides an initial check to eliminate some FALSE positives.

grep "\[pantheon: " subtake-output.txt | confirm_pantheon

Filtering Cargo Collective

Please note that for Cargo Collective this repo currently only provides an initial check to eliminate some FALSE positives.

grep "\[cargo: " subtake-output.txt | confirm_cargo

HTTP-fingerprint validators

The following services are validated by fetching the candidate host over HTTP(S) and looking for the provider's "domain not connected / unclaimed" error page. They need no config or credentials, and they short-circuit (return not-vulnerable) for the provider's own hostnames, which filters the bulk of self-referential false positives:

Command	Service	Fingerprint
`confirm_framer`	Framer	`Site Not Found \| Framer`
`confirm_leadpages`	Leadpages	"This page couldn't be found…"
`confirm_meteor`	Meteor / Galaxy	"No applications registered for host"
`confirm_surveysparrow`	SurveySparrow	"Account not found."
`confirm_greatpages`	GreatPages	"Página não encontrada (Erro 404)"
`confirm_wix`	Wix	"Error ConnectYourDomain occurred"
`confirm_mashery`	Mashery	"Unrecognized domain"

grep "\[framer: " subtake-output.txt | confirm_framer

These are also wired into the unified confirm_takeover dispatcher via their nuclei template ids (framer-takeover, leadpages-takeover, meteor-takeover, surveysparrow-takeover, greatpages-takeover, wix-takeover, mashery-takeover).

Separate tools

Extracting domain names

As part of my process I want to know the domains involved in my findings.

Example usage:

cut -f3 < subtake-output.txt | extract_domain_names | sort -u > involved.domains

Note that extract_domain_names also support groups, such as domain.(co.id|in.th|ph|vn), this will be expanded automatically.

Resolving from the authoritative DNS authority

For validation of the results I want to validate whether the DNS record is still accurate.

To do this we fetch the authoritative result's step by step from the authoritative DNS servers.

authoritative_resolve "github.com" "martinvw.nl"

Monitoring CNAMEs

The monitor_cnames tool re-checks known records against the authoritative nameserver and reports any drift. It reads one record per line from stdin in the format subdomain,target,record_type:

monitor_cnames < records.csv

It prints a message when a record was changed, removed, or returns no result; a record that still points to the expected target produces no output.

Lines starting with # are treated as comments and blank lines are ignored, so the input file can be annotated:

# production records
app.example.com,github.io,CNAME

Exporting and enriching

The subtake_enrich_and_export will split the existing output and add some additional columms:

has a wildcard
domain name
tld
still vulnerable
authoritative results

subtake_enrich_and_export < subtakee-output.txt

Metadata

Release files for subdomain-takeover-tools 0.58.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for subdomain-takeover-tools 0.58.0
File	Size	Uploaded
subdomain_takeover_tools-0.58.0.tar.gz	25.2 kB	Sep 19, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for subdomain-takeover-tools 0.58.0
File	Interpreter	ABI	Platform	Reset
subdomain_takeover_tools-0.58.0-py3-none-any.whl 36.8 kB Sep 19, 2026	Python 3	none	any	Details

Total release size: 61.9 kB

Release files / subdomain_takeover_tools-0.58.0.tar.gz

Download URL	subdomain_takeover_tools-0.58.0.tar.gz
Size	25.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`c7629a0483238242b4a20989baad694f45301162dec65f0e2a9d68fd3b709721`
BLAKE2b-256 checksum How to use checksums	`9e52455c72f6bd3889407b7a2c268d3279a98411d397801dc30c792564b1ffcf`
Upload date	Sep 19, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.9.6`

Release files / subdomain_takeover_tools-0.58.0-py3-none-any.whl

Download URL	subdomain_takeover_tools-0.58.0-py3-none-any.whl
Size	36.8 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`bd94acb47ca050e9fe9ace4947dc3a693ba6c2fd7de24a75490a88716fba0823`
BLAKE2b-256 checksum How to use checksums	`98b72b332aeb95de6e044bd06b77dfa4bf1df3245d657752ffc8908ce0ce438c`
Upload date	Sep 19, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.9.6`