ice3man543/subover

A Powerful Subdomain Takeover Tool

SubOver

Note - This project is discontinued. No more updates will be provided! Sorry!

But something more awesome will come soon!

Subover is a Hostile Subdomain Takeover tool originally written in python but rewritten from scratch in Golang. Since it's redesign, it has been aimed with speed and efficiency in mind. Till date, SubOver detects 30+ services which is much more than any other tool out there. The tool uses Golang concurrency and hence is very fast. It can easily detect and report potential subdomain takeovers that exist. The list of potentially hijackable services is very comprehensive and it is what makes this tool so powerful.

Installing

You need to have Golang installed on your machine. There are no additional requirements for this tool.

go get github.com/Ice3man543/SubOver

NOTE - Do not change the location of providers.json file. Or the tool will not work.

Usage

./SubOver -l subdomains.txt

• -l List of Subdomains
• -a Check all hosts regardless of CNAME (Time Consuming and prone to fp's)
• -t Number of concurrent threads. (Default 10)
• -v Show verbose output (Default False)
• -https Force HTTPS Connection (Default HTTP)
• -timeout Set custom timeout (Default 10)
• -h Show help message

Currently Checked Services

Github, Heroku, Unbounce, Tumblr, Shopify, Instapage, Desk, Tictail, Campaignmonitor, Cargocollective, Statuspage, Amazonaws, Cloudfront, Bitbucket, Smartling, Acquia, Fastly, Pantheon, Zendesk, Uservoice, Ghost, Freshdesk, Pingdom, Tilda, Wordpress, Teamwork, Helpjuice, Helpscout, Cargo, Feedpress, Surge, Surveygizmo, Mashery, Intercom, Webflow, Kajabi, Thinkific, Tave, Wishpond, Aftership, Aha, Brightcove, Bigcartel, Activecompaign, Compaignmonitor, Acquia, Proposify, Simplebooklet, Getresponse, Vend, Jetbrains, Azure

Count : 51

Screenshot

FAQ

Q: What should my wordlist look like?

A: Your wordlist should include a list of subdomains you're checking and should look something like:

backend.example.com
something.someone.com
apo-setup.fxc.something.com

Your tool sucks!

Yes, you're probably correct. Feel free to:

• Not use it.
• Show me how to do it better.

TODO

• Add more services :-)
• Improve the tool (There are many things that can be done :-) )

Development

Want to contribute? Great!

You can add more services or recommend any changes to the existing ones. Any kind of help is appreciated.

Or buy me a coffee \o/

License

BSD 2-Clause "Simplified" License

Contact

Meet me on Twitter:

Changelog

[1.2] 2018-05-19

• Refactored whole code making it cleaner
• Added better error handling and more verbose stuff
• Implemented checking all domains
• Fixed other stuff, etc...

[1.1.1] - 2018-03-20

• Providers corrected using EdOverflow's Awesome List
• Added Information regarding various takeovers to the tool

[1.1.0] - 2018-03-16

• Rewritten from scratch in Golang
• This time it's damn fast because of Go Concurrency.
• The console output looks better :-)

[1.0.0] - 2018-02-04

• Initial Release with 35 Services written in Python.
• Pretty Slow :-)

Credits

• subjack : Hostile Subdomain Takeover Tool Written In GO
• Subdomain Takeover Scanner by 0x94
• Anshumanbh : tko-subs
• EdOverflow : can-i-take-over-xyz

subover's Issues

Fave

Automatically check both HTTP and HTTPS for Cloudfront

First off, love the tool. Great work.

Since Cloudfront domains can be either HTTP or HTTPS, can you add functionality to also check whichever protocol wasn't supplied? Maybe this could be a boolean argument like --check-protocols or something.

I'd fork and add it, but I haven't learned Go yet.

Thanks!

invalid character '<' looking for beginning of value

hello how do i solve this error ?

sudo ./SubOver -l guardian.txt -v
invalid character '<' looking for beginning of value

providers.json

hello,
congrats for the tool, is awesome..!
can you please consider in the next release embedding providers.json in the tool so i wont have to change directory everytime i wanna scan some text file that is in an other dir ..
thanks

open providers.json: no such file or directory

i have seen other people having same problem has been resloved but i wsl2 and i dont see Iceman in my go github.com

Domain already in use

Hi,
Your tool gave me this output: Takeover Possible At :

This is the dig output:
DiG 9.11.3-1ubuntu1-Ubuntu <<>> CNAME unbouncepages.com
it determined that out of this output the domain is vulnerable to subdomain takeover,
when registering to unbouncepages.com to try to claim the original domain it says that the domain is already in use.

open providers.json: no such file or directory

Unable to find subdomain takeover for unbounce

create your wordlist with studio.wrike.com
this domain is takeover possible but your tool is unable to detect it.

open providers.json: no such file or directory

I am facing this error but i did not change the providers.json directory or nothing. I installed the tool and tried to run it and got that error.

Tool not providing output

When running the tool against a list there isn't any output from the tool within the terminal or the output file. It seems like the tool isn't actually running against the targets and just exits.

OS: High Sierra

Can't install SubOver!

So i can't install SubOver in my unix os

can u help me!

Fave

Installation issues in Kali Linux.

I am facing issues when installing the tool. The tool is fine, the installation method of golang has changed. Changing 'go get' command to 'go install' command followed by the source link and version does the job.

example command -

go install github.com/Ice3man543/SubOver@master

Differences from tko-subs?

Heya,

Curious what improvements/differences this has over https://github.com/anshumanbh/tko-subs and/or other existing tools to warrant the 'most powerful' label.

Always curious about new tools and how they can improve my efficiency :3

Check for www.sub.domain.com too

Hi,

It would be great if SubOver can also append www. in front of list provided and then check them to see if it gives different result.

Reference : https://www.freelists.org/post/bugbounty/Bug-bounty-tip-The-www-subdomain-takeover-trick

Regards,
@bugbaba

nothing shown

Hello i just got this ...

./SubOver -l subs.txt
SubOver v.1.2 Nizamul Rana (@Ice3man)

[~] Enjoy your hunt !

looks like the tool does not do anything

Hello,
When I execute this tool this is the output that I get:
Sub0ver -v -l domains.txt

It looks like the tool isn't working.
The content of the file domains.txt is a list of domains, for example:
www.example.com
new.domain.com
other.domain.com

Error: no such file or directory

If I run SubOver -l subdomains.txt like in the description an error appears:

SubOver v.1.2              Nizamul Rana (@Ice3man)
==================================================

open providers.json: no such file or directory

What is providers.json for a file?

Continues to run by not determining end of queue.

The Tool continues to run even when all the queue items have been checked.

There is a bug in the program. It keeps running indefinitely even on ending the queue. This leads to output not working. It's a good first issue for anyone to tackle.

I will fix it in future. But if someone does it, I'll be glad.

Detect Azure's traffic manager subdomains (trafficmanager.net)

Traffic Manager lets you route traffic within Azure. Using cnames to xxx.trafficmanager.net it's sometimes possible to takeover such routing. Portal link: https://portal.azure.com/#create/Microsoft.WebSite

More info: https://azure.microsoft.com/en-us/services/traffic-manager/

Installation issue

Hello sir,

Can i install it on windows7?if yes then what is the procedure and commands?

cannot find package "golang.org/x/net/publicsuffix"

When I try go build subover.go to install script, I get the following error:

/root/go/src/github.com/parnurzeal/gorequest/gorequest.go:32:2: cannot find package "golang.org/x/net/publicsuffix" in any of:
/usr/lib/go-1.11/src/golang.org/x/net/publicsuffix (from $GOROOT)
/root/go/src/golang.org/x/net/publicsuffix (from $GOPATH)

Please provide a complete installation guide.

Timeout is hardcoded instead of being taken from user input

SubOver/subover.go

Line 116 in ae4a856

_, body, errs := Get(target, 120, ForceHTTPS)

cannot find package

subover.go:10:5: cannot find package "github.com/parnurzeal/gorequest" in any of:
c:\go\src\github.com\parnurzeal\gorequest (from $GOROOT)
C:\Users\rizal\go\src\github.com\parnurzeal\gorequest (from $GOPATH)

I run it at windows? Is that possible?

Error message: open /src/github.com/Ice3man543/SubOver/providers.json: no such file or directory

I did what is written in the documentation:

go get github.com/Ice3man543/SubOver

Now, I find a new file ~/go/bin/SubOver in my personal home directory. When I now call ~/go/bin/SubOver, I get this message

$ ~/go/bin/SubOver -l output.temp 

SubOver v.1.2              Nizamul Rana (@Ice3man)
==================================================

open /src/github.com/Ice3man543/SubOver/providers.json: no such file or directory

Edit

I've done this on an Ubuntu 18.04 machine.

Wrong fmt.Print function

SubOver/subover.go

Line 166 in 7d7ca40

fmt.Println("\n[\033[31;1;4mCLOUDFRONT\033[0m] Takeover Possible At : %s With HTTP & HTTPS", s.Url)

Either use:

fmt.Printf("\n[\033[31;1;4mCLOUDFRONT\033[0m] Takeover Possible At : %s With HTTP & HTTPS\n", s.Url)

or

fmt.Println("\n[\033[31;1;4mCLOUDFRONT\033[0m] Takeover Possible At : " + s.Url + " With HTTP & HTTPS")

argument -o is useless

-o is useless coz results output only on screen and never to file. Please fix this

Installation Issue

I am getting below error when running the ./subover.go

./subover.go: line 1: //: Is a directory
./subover.go: line 2: package: command not found
./subover.go: line 4: syntax error near unexpected token newline' ./subover.go: line 4: import ('

Fave

Github page takeover doesn't work

You might need to update the providers.json to detect the Github Page TakeOver at

SubOver/providers.json

Line 4 in 0d5eed6

"cname":["github.io"],

For my case the DNS for the takeover looked like
github.github.io. 1412 IN CNAME sni.github.map.fastly.net.

What do you think about updating it to match the following ?
"cname":["github.io", "fastly.net", "github.com", "github.map"],

Cheers

[ERROR] request canceled while waiting for connection

i get this 2 errors while running the tool and it stops scanning the other subdomains:

2019/11/29 18:09:21 [ERROR] Get: asda.asde.com => [Get http://asda.asde.com/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)] 2019/11/29 18:09:21 [ERROR] Get: asda.asde222.com => [Get http://asda.asde222.com/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)]

Am i doing something wrong? i'm running the tool with go run subover.go -l subs.txt