VibeSecurity

Web attacks

What is Subdomain takeover?

Subdomain takeover is an attack where someone gains control of one of your subdomains because its DNS record still points at a hosting service or resource you have deleted, which the attacker then claims for themselves.

When you connect a subdomain such as demo.yourapp.com to a hosting platform, you usually add a CNAME record that points at an address owned by that platform. If you later delete the project but leave the DNS record in place, the record is left dangling. On some platforms anyone can create a new project that answers at the abandoned address, and your subdomain starts serving their content.

This matters more than a defaced page. Content on your subdomain is trusted by visitors and by browsers. Depending on how cookies and policies are scoped, a hostile subdomain can receive cookies set for the parent domain, host convincing phishing pages and obtain a valid certificate for that name.

People who build quickly collect these records without noticing: a preview on one host, a landing page on another, a docs site that was abandoned. Remove the DNS record before or at the same time as you delete the resource, review your DNS zone regularly, and avoid setting cookies for the whole parent domain unless you have to.

Go deeper

Related terms

Sources

  1. 1.MDN: Subdomain takeover
  2. 2.Microsoft Learn: Prevent dangling DNS entries and avoid subdomain takeover