# Subzy | Subdomain Takeover Vulnerability Tool

**URL:** <https://onehack.st/t/subzy-subdomain-takeover-vulnerability-tool/230523>\
**Category:** Tools & Scripts\
**Tags:** tools, privacy, freebies\
**Created:** [December 30, 2022, 9:52pm UTC](https://onehack.st/t/subzy-subdomain-takeover-vulnerability-tool/230523 "2022-12-30T21:52:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [December 30, 2022, 9:52pm UTC](https://onehack.st/t/subzy-subdomain-takeover-vulnerability-tool/230523/1 "2022-12-30T21:52:13Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/8/e8ddb9108c41bcf3f43e19f7891a19258f739a85.jpeg)

Subdomain takeover tool which works based on matching response fingerprints from [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz/blob/master/README.md)

### Installation

go get -u -v [github.com/lukasikic/subzy](http://github.com/lukasikic/subzy) go install -v [github.com/lukasikic/subzy@latest](http://github.com/lukasikic/subzy@latest)

If `$GOBIN` and `$GOPATH` are [properly set](https://github.com/golang/go/wiki/SettingGOPATH#bash), execute the program as:

subzy

If you get an error `exec format error: ./subzy`, you need to [install Golang](https://golang.org/doc/install) for your OS and compile the program by running `go build subzy.go` which will generate new `subzy` binary file

### Options

Only required flag is either `--target` or `--targets`

`--target` (string) - Set single or multiple (comma separated) target subdomain/s  
`--targets` (string) - File name/path to list of subdomains  
`--concurrency` (integer) - Number of concurrent checks (default 10)  
`--hide_fails` (boolean) - Hide failed checks and invulnerable subdomains (default false)  
`--https` (boolean) - Use HTTPS by default if protocol not defined on targeted subdomain (default false)  
`--timeout` (integer) - HTTP request timeout in seconds (default 10)  
`--verify_ssl` (boolean) - If set to true, it won’t check site with invalid SSL

### Usage

Target subdomain can have protocol defined, if not `http://` will be used by default if `--https` not specifically set to true.

- List of subdomains
  - `./subzy -targets list.txt`

- Single or multiple targets
  - `./subzy -target test.google.com`
  - `./subzy -target test.google.com,https://test.yahoo.com`

## GitHub:

> **[GitHub - PentestPad/subzy: Subdomain takeover vulnerability checker](https://github.com/PentestPad/subzy)**
>
> Subdomain takeover vulnerability checker