Top 25 Subdomain Takeover Bug Bounty Reports
In this article, we will discuss the Subdomain Takeover attack, and present 25 disclosed reports based on this flaw.
What is a Subdomain Takeover Vulnerability?
Theoretically, a Subdomain Takeover flaw is when an attacker can hijack the subdomain of a company, and control what content is being displayed when the users are navigating to that one.
Practically, you can do a Subdomain Takeover through hacking or registration of an existing DNS CNAME record of that subdomain.
Let’s take the following example:
- We have the domain “xyz.com” with the subdomain “victim.xyz.com”.
- The “victim.xyz.com” subdomain has a CNAME record that is pointing to another domain called “promotional-campaign-xyz.com”.
- You find that “promotional-campaign-xyz.com” expired and you are able to purchase it.
- Once you get “promotional-campaign-xyz.com” in your control, you will have a page displaying any arbitrary content you want, that will be displayed once a user accesses “victim.xyz.com”.
My Favorite Scenario: Subdomain Takeover through Cloud Services
I would like to mention one of my favorite scenarios of Subdomain Takeover, which is basically hijacking the CNAME records that are pointing to different Cloud-related services, such as Traffic Manager from Azure.
A list of domains related to Azure services that are suspected of being vulnerable is the following:
*.cloudapp.net
*.cloudapp.azure.com
*.azurewebsites.net
*.blob.core.windows.net
*.cloudapp.azure.com
*.azure-api.net
*.azurehdinsight.net
*.azureedge.net
*.azurecontainer.io
*.database.windows.net
*.azuredatalakestore.net
*.search.windows.net
*.azurecr.io
*.redis.cache.windows.net
*.azurehdinsight.net
*.servicebus.windows.net
*.visualstudio.comYou can find more services like that by taking a look over this GitHub repository:
Top 25 Subdomain Takeover Bug Bounty Reports
The reports were disclosed through the HackerOne platform and were selected according to their upvotes, bounty, severity level, complexity, and uniqueness.
#1
Title: Multiple Subdomain takeovers via unclaimed instances
Company: Starbucks
Bounty: $8,000
#2
Title: Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com
Company: Uber
Bounty: $5,000
#3
Title: Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com
Company: Starbucks
Bounty: $4,000
#4
Title: Subdomain takeover on http://fastly.sc-cdn.net/
Company: Snapchat
Bounty: $3,000
#5
Title: Subdomain Takeover to Authentication bypass
Company: Roblox
Bounty: $2,500
#6
Title: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com
Company: Uber
Bounty: $2,250
#7
Title: Subdomain takeover of mydailydev.starbucks.com
Company: Starbucks
Bounty: $2,000
#8
Title: Subdomain takeover of d02–1-ag.productioncontroller.starbucks.com
Company: Starbucks
Bounty: $2,000
#9
Title: Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record
Company: Starbucks
Bounty: $2,000
#10
Title: Subdomain takeover on svcgatewayus.starbucks.com
Company: Starbucks
Bounty: $2,000
#11
Title: Subdomain takeover of datacafe-cert.starbucks.com
Company: Starbucks
Bounty: $2,000
#12
Title: Subdomain takeover on wfmnarptpc.starbucks.com
Company: Starbucks
Bounty: $2,000
#13
Title: Subdomain takeover on developer.openapi.starbucks.com
Company: Starbucks
Bounty: $2,000
#14
Title: Possible subdomain takeover at openapi.starbucks.com
Company: Starbucks
Bounty: $2,000
#15
Title: URGENT — Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS
Company: Twitter
Bounty: $1,680
#16
Title: Subdomain takeover of storybook.lystit.com
Company: Lyst
Bounty: $1,000
#17
Title: Hacker.One Subdomain Takeover
Company: HackerOne
Bounty: $1,000
#18
Title: Subdomain takeover at info.hacker.one
Company: HackerOne
Bounty: $1,000
#19
Title: Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com
Company: Grab
Bounty: $1,000
#20
Title: Subdomain takeover #2 at info.hacker.one
Company: HackerOne
Bounty: $1,000
#21
Title: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront
Company: Uber
Bounty: $1,000
#22
Title: Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry
Company: Ubiquiti Inc.
Bounty: $1,000
#23
Title: Subdomain Takeover using blog.greenhouse.io pointing to Hubspot
Company: Greenhouse.io
Bounty: $1,000
#24
Title: Bulgaria — Subdomain takeover of mail.starbucks.bg
Company: Starbucks
Bounty: $1,000
#25
Title: Subdomain takeover of resources.hackerone.com
Company: HackerOne
Bounty: $500
Bonus: 10 Zero Dollars Subdomain Takeover Reports
#1
Title: Subdomain takeover on usclsapipma.cv.ford.com
Company: Ford
Bounty: $0
#2
Title: Subdomain takeover of v.zego.com
Company: Zego
Bounty: $0
#3
Title: Subdomain takeover dew to missconfigured project settings for Custom domain .
Company: Flock
Bounty: $0
#4
Title: Subdomain takeover of images.crossinstall.com
Company: Twitter
Bounty: $0
#5
Title: Subdomain takeover on dev-admin.periscope.tv
Company: Twitter
Bounty: $0
#6
Title: subdomain takeover at status0.stripo.email
Company: Stripo Inc
Bounty: $0
#7
Title: registry.nodejs.org Subdomain Takeover
Company: Node.js
Bounty: $0
#8
Title: GNIP subdomain take over
Company: Twitter
Bounty: $0
#9
Title: Domain Takeover in [obviousengine.com] a snapchat acquisitions
Company: Snapchat
Bounty: $0
#10
Title: [ii.worki.ru ] emarsys subdomain takeover
Company: Mail.ru
Bounty: $0
Thanks very much! Stay tuned for another article from the “Top 25 Bug Bounty Reports” series soon.
