dns_takeover

MCP tool from Fingerprint MCP by badchars

Subdomain takeover detection via dangling CNAME analysis

How to use it

Project documentation lists dns_takeover for the Fingerprint MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Fingerprint MCP

$npx -y fingerprint-mcp
FULL FINGERPRINT MCP LISTING

Other tools in Fingerprint MCP (39)

dns_caa

CAA record analysis for certificate authority restrictions

dns_email_auth

SPF, DKIM, and DMARC record analysis

dns_records

Full record enumeration — A, AAAA, MX, NS, TXT, CNAME, SOA

dns_saas

SaaS/service detection via CNAME and MX patterns (Slack, Zendesk, etc.)

dns_server

DNS server fingerprinting (BIND, PowerDNS, Cloudflare, etc.)

dns_zone

Zone transfer attempt (AXFR)

http_caching

HTTP

http_compression

HTTP

http_cookies

HTTP

http_cors

HTTP

http_error

HTTP

http_etag

HTTP

http_favicon

HTTP

http_header_order

HTTP

http_headers

HTTP

http_methods

HTTP

http_redirect

HTTP

http_robots

HTTP

http_security_headers

HTTP

http_sitemap

HTTP

http_timing

HTTP

http_wellknown

HTTP

tcp_analysis

Port combination analysis and service inference

tcp_banner

Banner grabbing on open ports for service identification

tcp_probe

TCP connect scan to detect open ports

tls_certificate

X.509 certificate parsing — subject, issuer, SANs, validity, chain

tls_ciphers

Cipher suite enumeration and strength analysis

tls_ct_logs

Certificate Transparency log lookup via crt.sh

tls_ja4x

JA4X passive TLS fingerprinting from certificate properties

tls_jarm

JARM active fingerprinting — 10 TLS Client Hello probes, 62-char hash

tls_ocsp

OCSP stapling and revocation status check

tls_protocols

Supported TLS protocol version detection (SSLv3 through TLS 1.3)

tls_sni

SNI behavior testing — default cert vs. requested hostname

web_analytics

Web

web_graphql

Web

web_sourcemaps

Web

web_spa

Web

web_tech

Web

web_websocket

Web