{"id":5410,"date":"2020-09-24T01:13:02","date_gmt":"2020-09-23T17:13:02","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5410"},"modified":"2020-09-24T01:20:48","modified_gmt":"2020-09-23T17:20:48","slug":"tko-subs-detect-takeover-subdomains-with-dead-dns-records","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2020\/09\/tko-subs-detect-takeover-subdomains-with-dead-dns-records\/","title":{"rendered":"tko-subs &#8211; Detect &#038; Takeover Subdomains With Dead DNS Records"},"content":{"rendered":"<p>tko-subs is a tool that helps you to detect &amp; takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services or to nothing at all or NS records that are mistyped.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-5477\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/09\/tko-subs-Detect-Takeover-Subdomains-With-Dead-DNS-Records-640x292.png\" alt=\"tko-subs - Detect &amp; Takeover Subdomains With Dead DNS Records\" width=\"640\" height=\"292\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/09\/tko-subs-Detect-Takeover-Subdomains-With-Dead-DNS-Records-640x292.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/09\/tko-subs-Detect-Takeover-Subdomains-With-Dead-DNS-Records.png 768w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>What does tko-subs &#8211; Detect &amp; Takeover Subdomains With Dead DNS Records Do?<\/h2>\n<p>This tool allows you:<\/p>\n<ul>\n<li>To check whether a subdomain can be taken over because it has:\n<ul>\n<li>a dangling CNAME pointing to a CMS provider (Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc.) that can be taken over.<\/li>\n<li>a dangling CNAME pointing to a non-existent domain name<\/li>\n<li>one or more wrong\/typoed NS records pointing to a nameserver that can be taken over by an attacker to gain control of the subdomain&#8217;s DNS records<\/li>\n<\/ul>\n<\/li>\n<li>To actually take over those subdomain by providing a flag <code>-takeover<\/code>. Currently, take over is only supported for Github Pages and Heroku Apps and by default the take over functionality is off.<\/li>\n<li>To specify your own CMS providers and check for them via the <a href=\"https:\/\/github.com\/anshumanbh\/tko-subs\/blob\/master\/providers-data.csv\">providers-data.csv<\/a> file. In that file, you would mention the CMS name, their CNAME value, their string that you want to look for and whether it only works over HTTP or not. Check it out for some examples.<\/li>\n<\/ul>\n<h3>How to install tko-subs to takeover subdomains with dead DNS records<\/h3>\n<p>You need GO installed. Once you have GO, just type <code>go get github.com\/anshumanbh\/tko-subs<\/code> to download the tool.<\/p>\n<p>Once the tool is downloaded, type <code>tko-subs -h<\/code>.<\/p>\n<p>The next thing we need to do is to get the following information:<\/p>\n<ul>\n<li>    Github&#8217;s Personal Access Token &#8211; Make sure this token has the rights to create repositories, references, contents, etc. You can create this token here &#8211; https:\/\/github.com\/settings\/tokens<\/li>\n<li>    Heroku Username and API key<\/li>\n<li>    Heroku app name &#8211; You can create a static app on Heroku with whatever you want to be displayed on its homepage by following the instructions here &#8211; <a href=\"https:\/\/gist.github.com\/wh1tney\/2ad13aa5fbdd83f6a489\">https:\/\/gist.github.com\/wh1tney\/2ad13aa5fbdd83f6a489<\/a>. Once you create that app, use that app name in the flag (see below). We will use that app to take over the domain (with the dangling CNAME to another Heroku app).<\/li>\n<\/ul>\n<p><strong>NOTE<\/strong> &#8211; You only need these values if you want to take over subdomains. By default, that&#8217;s not required.<\/p>\n<p>Required Go Packages to build.<\/p>\n<pre>go get github.com\/bgentry\/heroku-go\r\ngo get github.com\/gocarina\/gocsv\r\ngo get github.com\/google\/go-github\/github\r\ngo get github.com\/olekukonko\/tablewriter\r\ngo get golang.org\/x\/net\/publicsuffix\r\ngo get golang.org\/x\/oauth2\r\ngo get github.com\/miekg\/dns<\/pre>\n<p>You can download tko-subs here:<\/p>\n<p><a href=\"https:\/\/github.com\/anshumanbh\/tko-subs\/archive\/master.zip\">tko-subs-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/anshumanbh\/tko-subs\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>tko-subs is a tool that helps you to detect &amp; takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services or to nothing at all or NS records that are mistyped. What does tko-subs &#8211; Detect &amp; Takeover Subdomains With Dead DNS Records Do? This tool allows you: To check [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5477,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"tko-subs - Detect &amp; Takeover Subdomains With Dead DNS Records","_seopress_titles_desc":"tko-subs is a tool that helps you to detect &amp; takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/09\/tko-subs-Detect-Takeover-Subdomains-With-Dead-DNS-Records.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/09\/tko-subs-Detect-Takeover-Subdomains-With-Dead-DNS-Records.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5410"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5410"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5410\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5477"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}