KPSUB — Subdomain Takeover Bootcamp: From Discovery to Exploitation

What is a Subdomain Takeover?
- A subdomain takeover occurs when a company leaves a DNS record pointing to a third-party service, but the service itself is no longer configured or owned by the company.
- An attacker can claim that resource and serve content under the victim's subdomain.

Example:

Company removes the GitHub repository but forgets to remove the DNS record.

An attacker creates a GitHub Pages site and claims:
shop.example.com

Now the attacker controls:
<https://shop.example.com>

even though the company still owns:
example.com

https://github.com/rix4uni/subhijack

https://github.com/rix4uni/subdomain-takeover

cat subs.txt | httpx -silent | subhijack --onlycheck "Github" | tee -a subhijack.txt

cat subhijack.txt | awk '{print $3}' | grep "http" | sed 's#^https\?://##' | while read domain;do dig +short "$domain" | grep -qE '^185\.199\.(108|109|110|111)\.153$' && echo "$domain";done

GitHub Pages commonly uses the following IP addresses:
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153

We can quickly check whether a domain resolves to these IPs using, If we get same ip's that means this domain is vulnerable:
dig +short pawlishmobilegrooming.com | grep -E '^185\.199\.(108|109|110|111)\.153$'

cat domains.txt | unew | while read domain;do dig +short "$domain" | grep -qE '^185\.199\.(108|109|110|111)\.153$' && echo "$domain";done

https://github.com/edoverflow/can-i-take-over-xyz

Reports Example

https://hackerone.com/reports/1474784

https://hackerone.com/reports/325336

https://hackerone.com/reports/202767

https://hackerone.com/reports/1717626

https://hackerone.com/reports/1690951

https://hackerone.com/reports/154425

https://hackerone.com/reports/1256389

https://hackerone.com/reports/2499178

https://hackerone.com/reports/1487793

https://hackerone.com/reports/1253926

https://hackerone.com/reports/484420

https://hackerone.com/reports/1130376

https://hackerone.com/reports/317005

https://hackerone.com/reports/2523654

https://hackerone.com/reports/2899858

https://hackerone.com/reports/1527405

https://hackerone.com/reports/207576

Live Hunting Session

antidotesdaily.com
store.freerobby.com
svc.js-times.com
ff14fish-test.carbuncleplushy.com
club.freerobby.com
affiliate.js-times.com
developer.olery.com
ae1ff72f-f286-47c8-b08d-8420c3dc19a4.js-times.com
19.js-times.com
rlsbj.freerobby.com
neu.js-times.com
huodong.freerobby.com
mail.jsjgc.freerobby.com
yjs.freerobby.com
hd.freerobby.com
ffffffffffff.freerobby.com
mail.club.freerobby.com
home.freerobby.com
mail.dbis.freerobby.com
xzdhrm.freerobby.com
lzw.freerobby.com
hbj.freerobby.com
zj.freerobby.com
shop.freerobby.com
dbis.freerobby.com
shiji.freerobby.com
webmail.freerobby.com
ghmobile.freerobby.com
imap.freerobby.com
mail.list.freerobby.com
mail.hd.freerobby.com
pub.freerobby.com
mail.ghmobile.freerobby.com
smtp.ffffffffffff.freerobby.com
apk.js-times.com
mail.huodong.freerobby.com
mail.admission.freerobby.com
mail.liguiping.freerobby.com
mail.lzw.freerobby.com
mail.hbj.freerobby.com
smtp.yjs.freerobby.com
mail.yszy.freerobby.com
mail.shiji.freerobby.com
badomenbrewery.com
kaveatweaks.xyz
rypto.systems
nicenboim.me
enlightened-society.org
lasvirckys.com
srestho.online
numcom.site
boxten.xyz
momepy.org
amandaharlin.com
worldgate.one
tim-rottmann.me
eoinlynch.dev
school-library.site
ltankush.me
foryous.page
coeus.exchange
wangwei.party
horizonmind.me
147feiraoaprovehojepre.site
13aproveitepromocoesdejaneiro2026.shop
flinger.cc
draftkit.dev
jerveycalusin.tech
inkit.nyc
itsthatdev.tech
06novembrdesaldao2025.shop
09consultelistacadebci.shop
099clientvipfeirrafb2026.shop
02novembrdesaldao2025.shop
akulumbeg.com
rp2.strategy-x.com
jonasrichter.eu
webchat.azzurra.org
preservedsound.com
2014.eurucamp.org
ottie.xyz
altpq.com
solarmosaic.com
theia.computer
ww16.mcolodging.com
random.pellalodging.com
ucnumbers.com
wildcard.collegelodging.com
www-1.nassaulodging.com
ww6.nassaulodging.com
random.stkittslodging.com
random.sanjuanlodging.com
random.philadelphialodging.com
ww38.gulfportlodging.com
ww38.sanjuanlodging.com
random.sanibelislandlodging.com
random.simivalleylodging.com
wildcard.delawarelodging.com
ww25.burbanklodging.com
ww38.newarklodging.com
ww38.zurichlodging.com
qinyuchen.site
montesg.xyz
farsight.ai
portfolio.davenportlodging.com
helpdesk.lubbocklodging.com
ilyabruck.com
moduli-2025.ncag.info
faitpoms.com
skynettoday.com
mlr.press
lilichen.me
0x7e4.hackmeeting.org.bo
transferwiki.cn
cfp.bmvc2022.org
2021.emnlp.org
yurulin.com
edubuntu.com
cvpr2021.ug2challenge.org
blog.canumeet.com
github.github.com
annepein.com
sylvesterranjithfrancis.com
haoliu.wiki
godaura.org
tsafds.org
quraanly.org
ballifwedding.info
thiruhq.com
cpataxfilings.com
sgmgroup.site
myeyefy.com
passionfruit.cloud
containmentbreakers.art
kfcc.nyc
spinthewheels.in
fleetime.my.id
lifebow.net
propertypower.in
vmanishk.in
jbgsh.cn
tripar.in
charancodedev.me
worldstore17.net
pawlishmobilegrooming.com
cultivateownwealth.com
planners.austinconventioncenter.com
foryoucleaning.com
nagadimari.bryanchacosky.com
cair33.futurefriendlyweb.com
d.cair33.futurefriendlyweb.com
lite.datacalliope.com
jira.juanmacordoba.com
mail.marsrobertson.com
565752.shop
565760.shop
565758.shop
565759.shop
565753.shop
565751.shop
565754.shop
magnetslotku.protolambda.com
support.tonichaz.com
thedatacarpenter.com
webslotpg.ramdajs.com
id.softwarereality.com
rp2.strategy-x.com
jonasrichter.eu
webchat.azzurra.org
preservedsound.com
2014.eurucamp.org
ottie.xyz
altpq.com
solarmosaic.com
foryous.page
coeus.exchange
wangwei.party
horizonmind.me
147feiraoaprovehojepre.site
13aproveitepromocoesdejaneiro2026.shop
flinger.cc
draftkit.dev
jerveycalusin.tech
ilyabruck.com