Summary

This PR integrates Subjackal as a second-stage validator for Reconner's subdomain_takeover detection.

The goal is to reduce false positives by validating potential takeover candidates with Subjackal before Reconner reports them as confirmed findings.

The integration preserves Reconner's existing takeover detection as a fallback when Subjackal is unavailable or its execution fails.

Problem

Reconner's existing takeover detection can identify potential subdomain takeover candidates based on DNS and provider-specific fingerprints.

However, a provider-specific error page, dangling CNAME, or NXDOMAIN condition does not always mean that the subdomain is actually takeoverable.

This can result in false-positive takeover findings.

This PR addresses that by introducing a second-stage validation flow:

Recon / DNS detection
        ↓
Potential takeover candidate
        ↓
      Subjackal
        ↓
 ┌───────────────┐
 │ Vulnerable    │ → Confirmed finding
 │ Suspicious    │ → Candidate
 │ Dismissed     │ → Suppressed
 │ Alive/NXDomain│ → No finding
 └───────────────┘

Changes

1. Subjackal integration

Reconner now detects whether subjackal is available and uses it for takeover validation when possible.

The scanner:

• collects valid subdomains from Reconner's takeover candidates

• writes them to a temporary input file

• executes Subjackal in batch mode

• parses Subjackal's JSON stream output

• maps Subjackal results into Reconner's existing finding/candidate model

• cleans up temporary input/output files

• limits Subjackal workers according to Reconner's execution limits

2. Result handling

Subjackal results are mapped as follows:

Confirmed vulnerable results receive high confidence, while suspicious results remain candidates rather than being promoted to confirmed findings.

3. Native fallback

Subjackal is not a hard dependency for the scanner at runtime.

If:

• Subjackal is not installed,

• Subjackal cannot be executed, or

• the Subjackal batch execution fails,

Reconner falls back to its existing native takeover detection path.

This keeps the existing behavior available in environments where Subjackal is unavailable.

4. Tool installation and discovery

Subjackal has been added to Reconner's tool installation/catalog handling and expected tool inventory.

The Docker image now installs a pinned Subjackal version:

v0.10.0

The image also verifies that the binary is available and executable during the build.

5. Scanner logging

Takeover results now include Subjackal-specific information such as:

• validation status

• service/provider

• confidence

• score

• explanatory note

• CNAME/final-target information where available

This makes it easier to distinguish a potential takeover from a Subjackal-confirmed result during Reconner scans.

6. Tests

Added scanner tests covering:

• Subjackal JSON stream parsing

• takeover lifecycle integration

• Subjackal result mapping

• logging output

• native fallback when Subjackal is unavailable

Validation

The following checks pass:

go test ./internal/scanner
go test ./...
git diff --check

The working tree is clean after the changes.

Scope

This PR intentionally integrates Subjackal's native detection/validation output.

Deep Subjackal validation using:

subjackal --validate

is not enabled in this PR.

That functionality performs additional validation such as provider checks, DNS verification, CT/Wayback checks, and validation scoring. It is intentionally kept out of this change so that the current integration remains focused on the second-stage takeover detection path.

Backwards Compatibility

The existing Reconner takeover scanner remains available as a fallback.

No existing takeover detection functionality is removed.

If Subjackal is unavailable or fails during execution, Reconner continues using its native takeover detection logic.

Related Issue

Closes #21

Related issue:

False Positives in subdomain_takeover Detection

The intended outcome is to distinguish between:

• potential takeover

• Subjackal-validated takeover

• suspicious/candidate result

• dismissed/false-positive result

rather than treating every provider-specific takeover signal as a confirmed vulnerability.

Files Changed

The implementation is contained in:

• Dockerfile

• internal/api/tool_install.go

• internal/scanner/takeover.go

• internal/scanner/takeover_fp_test.go

• internal/scheduler/scheduler.go

Notes for Reviewers

The implementation is designed to be incremental and minimally invasive:

• no new Go module dependencies

• no database/schema changes

• no changes to the existing takeover fingerprint database

• no removal of the native takeover scanner

• Subjackal execution is isolated from the main scanner lifecycle

• temporary files are cleaned up after execution

• execution failures trigger the existing fallback path

• confirmed findings are only promoted from explicit Subjackal vulnerable results

The PR is intended to provide a reliable second-stage validation layer while keeping Reconner's existing behavior intact when the additional validator is unavailable.

This PR integrates [Subjackal](https://github.com/AliMousaviSoft/subjackal) as a second-stage validator for Reconner's subdomain_takeover detection.

The goal is to reduce false positives by validating potential takeover candidates with Subjackal before Reconner reports them as confirmed findings.

The integration preserves Reconner's existing takeover detection as a fallback when Subjackal is unavailable or its execution fails.

Problem

Reconner's existing takeover detection can identify potential subdomain takeover candidates based on DNS and provider-specific fingerprints.

However, a provider-specific error page, dangling CNAME, or NXDOMAIN condition does not always mean that the subdomain is actually takeoverable.

This can result in false-positive takeover findings.

This PR addresses that by introducing a second-stage validation flow:

Recon / DNS detection
        ↓
Potential takeover candidate
        ↓
      Subjackal
        ↓
 ┌───────────────┐
 │ Vulnerable    │ → Confirmed finding
 │ Suspicious    │ → Candidate
 │ Dismissed     │ → Suppressed
 │ Alive/NXDomain│ → No finding
 └───────────────┘

Changes

1. Subjackal integration

Reconner now detects whether subjackal is available and uses it for takeover validation when possible.

The scanner:

• collects valid subdomains from Reconner's takeover candidates
• writes them to a temporary input file
• executes Subjackal in batch mode
• parses Subjackal's JSON stream output
• maps Subjackal results into Reconner's existing finding/candidate model
• cleans up temporary input/output files
• limits Subjackal workers according to Reconner's execution limits

2. Result handling

Subjackal results are mapped as follows:

Confirmed vulnerable results receive high confidence, while suspicious results remain candidates rather than being promoted to confirmed findings.

3. Native fallback

Subjackal is not a hard dependency for the scanner at runtime.

If:

• Subjackal is not installed,
• Subjackal cannot be executed, or
• the Subjackal batch execution fails,

Reconner falls back to its existing native takeover detection path.

This keeps the existing behavior available in environments where Subjackal is unavailable.

4. Tool installation and discovery

Subjackal has been added to Reconner's tool installation/catalog handling and expected tool inventory.

The Docker image now installs a pinned Subjackal version:

v0.10.0

The image also verifies that the binary is available and executable during the build.

5. Scanner logging

Takeover results now include Subjackal-specific information such as:

• validation status
• service/provider
• confidence
• score
• explanatory note
• CNAME/final-target information where available

This makes it easier to distinguish a potential takeover from a Subjackal-confirmed result during Reconner scans.

6. Tests

Added scanner tests covering:

• Subjackal JSON stream parsing
• takeover lifecycle integration
• Subjackal result mapping
• logging output
• native fallback when Subjackal is unavailable

Validation

The following checks pass:

go test ./internal/scanner
go test ./...
git diff --check

The working tree is clean after the changes.

Scope

This PR intentionally integrates Subjackal's native detection/validation output.

Deep Subjackal validation using:

subjackal --validate

is not enabled in this PR.

That functionality performs additional validation such as provider checks, DNS verification, CT/Wayback checks, and validation scoring. It is intentionally kept out of this change so that the current integration remains focused on the second-stage takeover detection path.

Backwards Compatibility

The existing Reconner takeover scanner remains available as a fallback.

No existing takeover detection functionality is removed.

If Subjackal is unavailable or fails during execution, Reconner continues using its native takeover detection logic.

Related Issue

Closes #21

Related issue:

False Positives in subdomain_takeover Detection

The intended outcome is to distinguish between:

• potential takeover
• Subjackal-validated takeover
• suspicious/candidate result
• dismissed/false-positive result

rather than treating every provider-specific takeover signal as a confirmed vulnerability.

Files Changed

The implementation is contained in:

• Dockerfile
• internal/api/tool_install.go
• internal/scanner/takeover.go
• internal/scanner/takeover_fp_test.go
• internal/scheduler/scheduler.go

Notes for Reviewers

The implementation is designed to be incremental and minimally invasive:

• no new Go module dependencies
• no database/schema changes
• no changes to the existing takeover fingerprint database
• no removal of the native takeover scanner
• Subjackal execution is isolated from the main scanner lifecycle
• temporary files are cleaned up after execution
• execution failures trigger the existing fallback path
• confirmed findings are only promoted from explicit Subjackal vulnerable results

The PR is intended to provide a reliable second-stage validation layer while keeping Reconner's existing behavior intact when the additional validator is unavailable.