Beginner LevelWeb Security & Cyber Defense
What is a Subdomain Takeover and how does a dangling CNAME record cause it?
❓ Interview Prompt: Explain Subdomain Takeover, dangling DNS CNAME records, orphaned cloud resources (S3, GitHub Pages), and domain verification.
A Subdomain Takeover occurs when an organization's DNS CNAME record points to an external third-party cloud service that has been deleted or unclaimed:
Attack Scenario:
1
Company configures DNS: 'sub.company.com CNAME company-bucket.s3.amazonaws.com'.
2
Company later deletes the S3 bucket, but forgets to remove the DNS CNAME record (Dangling CNAME!).
3
Attacker claims 'company-bucket' on AWS S3.
4
Attacker now controls 'sub.company.com', serving malicious content or stealing authentication cookies scoped to '.company.com'!
Code Implementation Example
bash
# Verify DNS CNAME record targets using dig CLI:
dig CNAME sub.example.com +short💡Inspecting DNS CNAME record targets with dig CLI.
🎯 Interview Key Takeaway
Remove orphaned DNS CNAME records promptly to prevent attackers from executing subdomain takeovers.
#Subdomain Takeover#DNS Security#CNAME#Beginner
Back to all Web Security & Cyber Defense Questions→