Subdomain takeovers are a common threat for any organization with extensive domain and DNS holdings. On a basic level, they enable threat actors to redirect traffic intended for an organization’s domain, to a site performing malicious activity.
Takeovers occur when a DNS record points to a deprovisioned resource - such DNS records are also known as "dangling" DNS entries.
CNAME records are of particular importance in subdomain takeovers, given their ability to map hostnames together, and delegate IP resolution.
Silent Push pre-aggregates global DNS data, and flags any records that are considered to be dangling, on a weekly basis. We achieve this by collecting all current CNAME, MX or NS records and subtracting all current A and AAAA records – the remaining CNAME, MX and NS records are then searchable on the platform.
As well as a more comprehensive lookup, Silent Push also provides a quick PADNS search that identifies dangling DNS records for a given domain.
-
Navigate to
Advanced Query Builder > Xperimental Queries > PADNS Report On Dangling Records -
Specify a
domain -
(Optional) Choose a
DNS record typeto focus on:CNAMEMXNSALL
-
(Optional) Select
counts_onlyto only output a count of records -
(Optional) Select
changes_onlyto only show changed records -
Click
Search
Saving queries
Organizational users are able to save individual queries ran from Advanced Query Builder, and store them in the Private Queries menu for future analysis, or to share with their organization.
-
Specify the query parameters
-
Click
Save Query -
Give your query a
Name -
Specify a
Descriptionto add more context -
Click
Save