DedSec Security Research · 2026-10-17
A subdomain takeover sounds exotic and turns out to be mundane. Nobody breached a server. Nobody guessed a password. A DNS record simply outlived the thing it pointed at, and someone else claimed what was left — on a hostname that still carries your name.
Most takeovers follow the same shape. A team spins up something on a third-party service — a documentation site, a storefront, a cloud bucket, a support portal — and points a subdomain at it with a CNAME: \