ShadowSaaS Surface Scanner, the tool I introduced in a previous article, has picked up proxy support in the newly released v1.1. The reason for adding that support is less about the scanner and more about how real engagements actually work.
Most subdomain takeover tooling assumes a flat, direct path to the internet, but real engagements rarely look like that. A client hands you a jump host reachable only through SSH dynamic forwarding. A segmented network routes everything through a single egress point you don’t control. Or you simply want to watch your own tool’s traffic go by in Burp before you trust what it tells you. You apply the same care to the tool that produces the findings as you would apply to any finding. None of that is unusual, it’s routine work. But, if your scanner only knows how to talk directly to the internet, the kinds of engagements you can trust with grow increasingly narrow.
From a real-world security testing perspective, the actual gap is not detection logic, but the assumption of network topology. ShadowSaaS was already designed to be deliberately conservative about what it calls a takeover: multiple independent signals required, no flagging maybes, no chasing volume. Routing its traffic through http://, https://, socks5://, or socks5h:// extends that same discipline to the transport layer. If I’m requiring strong evidence before I trust a finding that I test by hand, I should require the same rigor before I trust that the request even reached the target the way I assumed it did.
That rigor cuts both directions: As soon as a scanner can be routed through infrastructure it doesn’t control, it finds a new way to be silently wrong. A misrouted request and a genuinely offline host can produce the exact same empty result if the tool isn’t built to tell them apart. From an attacker’s point of view, that ambiguity is a gift. I don’t need to evade a scanner that’s configured correctly. I just need the tester’s network path to be slightly off, and the tool to treat that failure identically to “nothing here.”
So, the proxy support in v1.1 isn’t just “it can now route through SOCKS5.” It validates the proxy URL before using it, rejects malformed configurations immediately instead of failing downstream with an opaque error. When a transport-layer problem means an entire target can’t be trusted, it says so explicitly in the output, not just in a scroll of console logs. A report that reads “zero subdomains found” should mean the attack surface really is empty, not that something upstream of the detection logic quietly gave up.
Validation doesn’t stop at the finding. It must extend to the path the finding traveled on to reach you.
ShadowSaaS Surface Scanner v1.1 is open source and available on GitHub. Run it against your own infrastructure, route it through whatever your engagement requires, and see which results hold up.
Wondering what’s dangling on your external surface?
Forgotten subdomains, orphaned SaaS integrations, and stale DNS records are exactly what our team looks for during an external penetration test. If you want to know what’s exposed, reach out.
