Subdomain Takeover Simulator
Five DNS records, one dangling CNAME pointing at a deleted third-party resource. Find it before someone else claims it.
Five DNS records, one of which points at a third-party resource that no longer exists. Claim that resource and you own content served from the target's own domain — with their certificate, their cookies, and their reputation.
How to use it
- Review the DNS records.
- Identify the CNAME pointing somewhere unclaimed.
- Understand exactly what claiming it would grant.
What to take away
Decommissioning order matters
The record outlives the resource because teams delete the service and forget the DNS entry. Remove the record first.
The impact is the domain, not the page
Content on a trusted subdomain can receive cookies scoped to the parent domain, pass domain validation for certificates, and defeat every "check the URL" instinct.
Frequently asked questions
How do I find dangling records?
Enumerate your subdomains, resolve each one, and check whether the target still exists and is still yours. Continuous monitoring beats a one-off audit.
Why do bug bounty programmes pay well for these?
Because impact is high, exploitation is trivial, and the fix is a single DNS deletion. High severity, low effort, no downside to fixing.
Where this fits in the course
This security lab pairs with Path 15 — Bug Bounty — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- DNS Recon Playground — A simulated dig. Query a target's likely subdomains and build a map of its real, sometimes-forgotten attack surface.
- OSINT Sandbox — A safe, fake company profile — practise open-source recon technique without touching anything real.
- Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.