Every domain collects old DNS records. A campaign site that was shut down, a test server that was never removed, a hosting account that expired. The record stays, and it keeps pointing at a server that is no longer yours. That is how subdomain takeovers happen. I added a report for this to ShadowTrackr, and I extended the webhook options so you can get the alerts in the tools you already use.
The new report lists web addresses of yours that point to a server that is not set up for them. You can run it from the search bar with $subdomain_takeover_report. It also appears in the report library under the DNS category, where you can schedule it.
Each result is one of two things:
Addresses that point to another domain of your own organisation are left out, because those are not findings. Possible takeovers are listed first. The fix is usually simple: remove the DNS record, or point the name back to a server you control.
The weekly PDF report now has a "Subdomain takeover" section too. It sits in the urgent part of the report, so you will see these findings without having to go looking for them.
An alert can call a webhook instead of sending an email. Choose Call webhook as the action and pick a payload:
You can also add up to 10 custom headers to every call, for example an Authorization header to authenticate to the receiving tool. Header values are stored encrypted and shown masked after you save.
A good combination is an alert on $subdomain_takeover_report that posts to your security channel. The same applies to any other query.
One thing to know: ShadowTrackr verifies the TLS certificate of your endpoint, and there is no option to switch that off. A self-signed certificate is refused. This matters for self-managed Splunk, which ships with a self-signed certificate. The documentation has step-by-step instructions for each tool.