After gathering all the subdomains using subdog

echo "example.com" | subdog --all --silent | unew sub.txt

use the command to see the vulnerable subdomains to takeover

cat subs.txt | httpx -silent | subhijack --onlycheck "Github" | tee -a subhijack.txt

cat subhijack.txt | awk '{print $3}' | grep "http" | sed 's#^https\?://##' | while read domain;do dig +short "$domain" | grep -qE '^185\.199\.(108|109|110|111)\.153$' && echo "$domain";done

cat subs.txt | httpx -silent | subhijack --onlycheck "Github" | tee -a subhijack.txt ( if we want to check other services also for subdomain takeover we can remove the tag --onlycheck "Github" )

image.png

take over is possible only on alive websites

when we found one is vulnerable

  1. go to github and create a repo using the domain name
  2. add a index.html and a readme in the repo
  3. enter the domain name in the custom domain and enter save wait until the DNS check is completed

image.png

image.png

if the DNS check failed then it is not vulnerable to do subdomain takeover

image.png