> For the complete documentation index, see [llms.txt](https://syed-muhammad-abdul-karim.gitbook.io/learn-to-hack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://syed-muhammad-abdul-karim.gitbook.io/learn-to-hack/security-tools/miscellaneous/subdomain-takeover.md).

# Subdomain Takeover

* [subjack](https://github.com/haccer/subjack) - Subdomain Takeover tool written in Go
* [SubOver](https://github.com/Ice3man543/SubOver) - A Powerful Subdomain Takeover Tool
* [autoSubTakeover](https://github.com/JordyZomer/autoSubTakeover) - A tool used to check if a CNAME resolves to the scope address. If the CNAME resolves to a non-scope address it might be worth checking out if subdomain takeover is possible.
* [NSBrute](https://github.com/shivsahni/NSBrute) - Python utility to takeover domains vulnerable to AWS NS Takeover
* [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) - "Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.
* [cnames](https://github.com/cybercdh/cnames) - take a list of resolved subdomains and output any corresponding CNAMES en masse.
* [subHijack](https://github.com/vavkamil/old-repos-backup/tree/master/subHijack-master) - Hijacking forgotten & misconfigured subdomains
* [tko-subs](https://github.com/anshumanbh/tko-subs) - A tool that can help detect and takeover subdomains with dead DNS records
* [HostileSubBruteforcer](https://github.com/nahamsec/HostileSubBruteforcer) - This app will bruteforce for exisiting subdomains and provide information if the 3rd party host has been properly setup.
* [second-order](https://github.com/mhmdiaa/second-order) - Second-order subdomain takeover scanner
* [takeover](https://github.com/mzfr/takeover) - A tool for testing subdomain takeover possibilities at a mass scale.