Subdomain Takeover Tools

A set of tools to validate the initial outcome of subtake.

Installation

Install using pip:

pip install subdomain_takeover_tools

for windows:

py -m pip install subdomain_takeover_tools

Alternatively, you can download or clone this repo and call pip install -e ..

Confirming takeovers

All scripts support the following two parameters:

--strict: only report as vulnerable if the issue is not also applicable on hostname.tld and www.hostname.tld.
--inverse: do inverse reporting, so report all subdomains that are not vulnerable

Supported input formats

In addition to plain hostnames, the scripts accept the output of two scanners and auto-detect which one is used per line:

subtake: [service: target]<tab><tab>domain
nuclei takeover templates: [template-id] [protocol] [severity] url ["extracted-cname"]

For the unified confirm_takeover dispatcher, nuclei template ids such as github-takeover and aws-bucket-takeover are mapped to the matching service validator automatically. Findings for services without a validator are considered unsupported and dropped by default. The dispatcher accepts two extra parameters:

--full: output the full input line instead of just the domain.
--include-unsupported: also emit unsupported findings (services with no validator), so a single pass over nuclei output keeps both confirmed-vulnerable and not-yet-disproven findings.

Some scripts require a config file to be present, the location is .subdomain_takeover_tools.ini, an example of the file can be found below:

[azure]
subscription_id=44713cf2-8656-11ec-a8a3-0242ac120002
[github]
username=martinvw
access_token=44713cf2-8656-11ec-a8a3-0242ac120002
repo=44713cf2-8656-11ec-a8a3-0242ac120002
[fastly]
api_token=44713cf2-8656-11ec-a8a3-0242ac120002
service=44713cf2-8656-11ec-a8a3-0242ac120002
version=3

Confirming S3

Subtake has some false positives on Google Cloud buckets as S3 buckets, also some access denied's end up in the results.

The script confirm-s3.py will make sure that the bucket is actually vulnerable.

grep "\[s3 bucket: " subtake-output.txt | confirm_s3

Confirming ELB

Some patterns of elb are vulnerable while others are not, to filter them we can use our script:

grep "\[elasticbeanstalk: " subtake-output.txt | confirm_elb

Note: the parameter --strict is accepted here but will not lead to expected results.

Please note that some regions are not enabled by default, when you receive the following error:

botocore.exceptions.ClientError: An error occurred (InvalidClientTokenId) when calling the CheckDNSAvailability operation: The security token included in the request is invalid.

This could mean you have not yet enabled these, opt-in, regions, see https://console.aws.amazon.com/billing/home?#/account

Confirming Shopify

It seems that all current shopify examples are vulnerable, the following check just validates the DNS.

grep "\[shopify: " subtake-output.txt | confirm_shopify

Filtering Pantheon

Please note that for pantheon this repo currently only provides an initial check to eliminate some FALSE positives.

grep "\[pantheon: " subtake-output.txt | confirm_pantheon

Filtering Cargo Collective

Please note that for Cargo Collective this repo currently only provides an initial check to eliminate some FALSE positives.

grep "\[cargo: " subtake-output.txt | confirm_cargo

HTTP-fingerprint validators

The following services are validated by fetching the candidate host over HTTP(S) and looking for the provider's "domain not connected / unclaimed" error page. They need no config or credentials, and they short-circuit (return not-vulnerable) for the provider's own hostnames, which filters the bulk of self-referential false positives:

Command	Service	Fingerprint
`confirm_framer`	Framer	`Site Not Found \| Framer`
`confirm_leadpages`	Leadpages	"This page couldn't be found…"
`confirm_meteor`	Meteor / Galaxy	"No applications registered for host"
`confirm_surveysparrow`	SurveySparrow	"Account not found."
`confirm_greatpages`	GreatPages	"Página não encontrada (Erro 404)"
`confirm_wix`	Wix	"Error ConnectYourDomain occurred"
`confirm_mashery`	Mashery	"Unrecognized domain"

grep "\[framer: " subtake-output.txt | confirm_framer

These are also wired into the unified confirm_takeover dispatcher via their nuclei template ids (framer-takeover, leadpages-takeover, meteor-takeover, surveysparrow-takeover, greatpages-takeover, wix-takeover, mashery-takeover).

Separate tools

Extracting domain names

As part of my process I want to know the domains involved in my findings.

Example usage:

cut -f3 < subtake-output.txt | extract_domain_names | sort -u > involved.domains

Note that extract_domain_names also support groups, such as domain.(co.id|in.th|ph|vn), this will be expanded automatically.

Resolving from the authoritative DNS authority

For validation of the results I want to validate whether the DNS record is still accurate.

To do this we fetch the authoritative result's step by step from the authoritative DNS servers.

authoritative_resolve "github.com" "martinvw.nl"

Monitoring CNAMEs

The monitor_cnames tool re-checks known records against the authoritative nameserver and reports any drift. It reads one record per line from stdin in the format subdomain,target,record_type:

monitor_cnames < records.csv

It prints a message when a record was changed, removed, or returns no result; a record that still points to the expected target produces no output.

Any record type is supported, including records with multiple values such as MX. For MX the target is the mail exchange host only, without the priority number:

example.org,gone.example.org,MX

The target field may list several expected values separated by ;. The check is a presence check: it reports drift when a listed target is no longer among the resolved records and ignores any additional records:

www.example.com,a.example.net;b.example.net,A

Lines starting with # are treated as comments and blank lines are ignored, so the input file can be annotated:

# production records
app.example.com,github.io,CNAME

Exporting and enriching

The subtake_enrich_and_export will split the existing output and add some additional columms:

has a wildcard
domain name
tld
still vulnerable
authoritative results

subtake_enrich_and_export < subtakee-output.txt

Metadata

Release files for subdomain-takeover-tools 0.59.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for subdomain-takeover-tools 0.59.0
File	Size	Uploaded
subdomain_takeover_tools-0.59.0.tar.gz	26.4 kB	Sep 20, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for subdomain-takeover-tools 0.59.0
File	Interpreter	ABI	Platform	Reset
subdomain_takeover_tools-0.59.0-py3-none-any.whl 38.2 kB Sep 20, 2026	Python 3	none	any	Details

Total release size: 64.6 kB

Release files / subdomain_takeover_tools-0.59.0.tar.gz

Download URL	subdomain_takeover_tools-0.59.0.tar.gz
Size	26.4 kB
Tags	Source
SHA-256 checksum How to use checksums	`a8e206b4fa9f73accc113bb13d35083679900fdc366a63454f35a31662664192`
BLAKE2b-256 checksum How to use checksums	`0dcb3ef69e243fefb1098ffeca0a411afbc168d001773cf2c106881e5614571e`
Upload date	Sep 20, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.9.6`

Release files / subdomain_takeover_tools-0.59.0-py3-none-any.whl

Download URL	subdomain_takeover_tools-0.59.0-py3-none-any.whl
Size	38.2 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`a3cf62841153e614adfca3c383046af1efba3436ed2139eacef10d6b1f71d843`
BLAKE2b-256 checksum How to use checksums	`4c253da8767ac2646f16cd2094c56e6647a3fb8d85816f0b06dab70df10a7552`
Upload date	Sep 20, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.1.0 CPython/3.9.6`