can-i-take-over-dns - "Can I take over DNS?" — a list of DNS providers a

项目说明

<h1 align="center">Can I Take Over DNS?<br><sup><sub>A list of DNS pro and whether their zones are to DNS takeover!<br>^{Maintained by} <a target="_blank" href=" src=" </h1>

Inspired by the popular Can I Take Over XYZ? project by @EdO this project is uniquely oriented towards DNS takeovers. DNS takeovers pose a high threat to companies, warrant high bounties, and are easy to find. We are trying to make this list comprehensive, so please contribute!

Reporting to Bug Bounty Programs

Here's a public $500 bounty report for a DNS takeover that I wrote with a thorough explanation to help you understand the issue and give you a template for how to write your own report.

Remember, <ins>always create a valid proof of concept</ins> (like the text record I added to the DNS zone in this report) before you report an issue to a bug bounty program, this will save time and get you paid faster. This list is updated infrequently (due to the fact things don't change that fast), so it is possible something listed below as is now Not . To that end, be sure to always perform a proof of concept takeo reporting.

DNS Pro

These companies provide DNS nameser to the general public. In this list you will find out whether domains pointing to these nameservers are to DNS takeover and where you can learn more about them.

Provider | Status | Fingerprint | Takeo
--------------------------------------------- | -------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------
000Domains | Not | ns1.000domains.com<br>ns2.000domains.com<br>fwns1.000domains.com<br>fwns2.000domains.com | Issue #19
AWS Route 53 | Not | ns-\*\*\*\*.awsdns-\*\*.org<br>ns-\*\*\*\*.awsdns-\*\*.co.uk<br>ns-\*\*\*.awsdns-\*\*.com<br>ns-\*\*\*.awsdns-\*\*.net | Issue #1
Azure (Microsoft) | Edge Case | ns1-\*\*.azure-dns.com<br>ns2-\*\*.azure-dns.net<br>ns3-\*\*.azure-dns.org<br>ns4-\*\*.azure-dns.info | Issue #5
BigCommerce | Not | ns1.bigcommerce.com<br>ns2.bigcommerce.com<br>ns3.bigcommerce.com | Issue #35
Bizland | Not | ns1.bizland.com<br>ns2.bizland.com<br>clickme.click2site.com<br>clickme2.click2site.com | Issue #3
ClouDNS | Not | \*.cloudns.net |
Cloudflare | Not | \*.ns.cloudflare.com | Issue #10
Digital Ocean | | ns1.digitalocean.com<br>ns2.digitalocean.com<br>ns3.digitalocean.com | Issue #22
DNSMadeEasy | | ns\*\*.dnsmadeeasy.com | Issue #6
DNSimple | Not | ns1.dnsimple.com<br>ns2.dnsimple.com<br>ns3.dnsimple.com<br>ns4.dnsimple.com | Issue #16
Domain.com| (w/ purchase) | ns1.domain.com<br>ns2.domain.com | Issue #17
DomainPeople| Not | ns1.domainpeople.com<br>ns2.domainpeople.com | Issue #14
Dotster| Not | ns1.dotster.com<br>ns2.dotster.com<br>ns1.nameresolve.com<br>ns2.nameresolve.com | Issue #18
Dreamhost| Edge Case | ns1.dreamhost.com<br>ns2.dreamhost.com<br>ns3.dreamhost.com | Issue #40
EasyDNS | Not | dns1.easydns.com<br>dns2.easydns.net<br>dns3.easydns.org<br>dns4.easydns.info| Issue #9
Gandi.net | Not | a.dns.gandi.net<br>b.dns.gandi.net<br>c.dns.gandi.net |
Google Cloud | Edge Case | ns-cloud-\*\*.googledomains.com | Issue #2
Hostinger (old NS) | Not | ns1.hostinger.com<br>ns2.hostinger.com |
Hover | Not | ns1.hover.com<br>ns2.hover.com | Issue #21
Hurricane Electric | | ns5.he.net<br>ns4.he.net<br>ns3.he.net<br>ns2.he.net<br>ns1.he.net | Issue #25
Linode | | ns1.linode.com<br>ns2.linode.com | Issue #26
MediaTemple (mt) | Not | ns1.mediatemple.net<br>ns2.mediatemple.net | Issue #23
MyDomain | Not | ns1.mydomain.com<br>ns2.mydomain.com | Issue #4
Name.com | (w/ purchase) | ns1*.name.com<br>ns2*.name.com<br>ns3*.name.com<br>ns4*.name.com | Issue #8
namecheap | Not </sup> | \*.namecheaphosting.com<br>\*.registrar-servers.com |
Network Solutions | Not | ns\*\*.worldnic.com | Issue #15
NS1 | Registration Closed <br>I can help, comment on the linked issue. | dns1.p\*\*.nsone.net<br>dns2.p\*\*.nsone.net<br>dns3.p\*\*.nsone.net<br>dns4.p\*\*.nsone.net | Issue #7
TierraNet | | ns1.domaindiscover.com<br>ns2.domaindiscover.com | Issue #24
Reg.ru | <br>(sanctions may stop payments) | ns1.reg.ru<br>ns2.reg.ru | Issue #28
UltraDNS | Not | pdns*.ultradns.com<br>udns*.ultradns.com<br>sdns***.ultradns.com | Issue #29
Yahoo Small Business | (w/ purchase) | yns1.yahoo.com<br>yns2.yahoo.com | Issue #20

Private DNS

These are private nameservers operated by companies. The general public cannot create zones on these nameservers and thus takeovers are not possible. Knowning nameservers that are private and not can be helpful to eliminate false positives from your testing.

Owner | Status | Fingerprint |
--------------------------------------------- | -------------- | ----------------------------------------------------------------------- |
Acti | Not | ns\*.acti.com |
Adobe | Not | adobe-dns-0*.adobe.com |
Apple | Not | a.ns.apple.com<br>b.ns.apple.com<br>c.ns.apple.com<br>d.ns.apple.com |
Automattic | Not | ns*.automattic.com |
Capital One | Not | ns*.capitalone.com |
Disney | Not | ns*.twdcns.com<br>ns*.twdcns.info<br>ns*.twdcns.co.uk |
Google | Not | ns*.google.com |
Lowe's | Not | authns*.lowes.com |
T-Mobile | Not | ns10.tmobileus.com<br>ns10.tmobileus.net |

What is a DNS takeover?

> DNS takeo occur when a subdomain (subdomain.example.com) or domain has its authoritati set to a provider (e.g. AWS Route 53, Akamai, Microsoft Azure, etc.) but the hosted zone has been removed or deleted. Consequently, when making a request for DNS records the ser with a SERVFAIL error. This allows an attacker to create the missing hosted zone on the service that was being used and thus control all DNS records for that (sub)domain. <!--For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com.-->

You can read more at:

A python implementation of DNS takeovers:

Contributions

We need more DNS pro added to the database with information about their services.

If you want to help out, please check out the getting started guide here.

Press

>"How does one know whether a DNS provider is exploitable? There is a frequently updated list published on GitHub called “Can I take over DNS,” which has been documenting exploitability by DNS provider over the past several years."<br>Brian Krebs

>"I honestly think this is a great resource for security researchers and bug bounty hunters."<br>
@0xpatrik

>"A new, but incredibly useful resource.. Essentially, a more modern/accurate can-i-take-over list for the STO you likely don't yet know about"<br>
Michael Skelton, Director of Security @ BugCrowd

> "Still trying to find your first domain/subdomain takeo? Go to indianajson/can-i-take-o for a curated DNS takeover list. "<br>Intigriti, Bug Bounty Platform

> "There's this excellent resource on GitHub... which has a list of nameservers... that you can perform takeovers on, so I think this is an excellent resource" <br>Shubham Shah, CTO of Assetnote

.

项目信息

开发语言：未知

Star 数：1106

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕"Can I take over DNS?" — a list of DNS providers and how to claim vulnerable domains.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。