subjack (subdomain takeover)

subjack -w <subdomains.txt> -t 100 -ssl

Subdomain scanner that detects if a subdomain points to an external service (e.g., GitHub, Heroku) that is no longer linked, allowing takeover.

When you have a list of subdomains (from tools like sublist3r) and want to check if any are vulnerable to takeover. Subjack verifies if the subdomain has a CNAME to an external provider and if the resource does not exist, it reports it as vulnerable.

If the target does not use external services or if all subdomains are internal. Also if takeover is not in the pentest scope.