Hi, in this tutorial we will see what is Sub domain take over and how it works.

The Subdomain takeover is considered to be highly vulnerable and it could cause to control complete subdomain takeover. The takeover could be done only if the subdomain is using third-party services.

So what happens in it???

For example, we have the main domain as praveen.com and we got subdomain hosted at Heroku, Github or Squarespace. The service can be like workhard.herokudns.com and it is linked to work.praveen.com, so if the user hits work.praveen.com it will redirect to workhard.herokudns.com.

After sometime we decided not to use it or subscription got over, by now if some attacker finds out a service workhard.herokudns.com and claims it, he could get access to it and our redirect will work.

So if our client returns to site work.praveen.com then he will be directed to that site and the attacker might have some login page to capture data or any malicious site which may be dangerous and the client could be hacked and our details too.

Prevention:

It can be protected only by removing unnecessary links and domain.