How to Hunt Subdomain Takeovers for Bug Bounties
A subdomain takeover happens when DNS still points at a third-party service you can claim — but the service account/resource no longer exists.
If you can claim it, you may control content on a trusted subdomain. That can lead to cookie scope issues, OAuth redirect abuse, or brand impersonation — depending on the program.
Quick takeaway: Enumerate subdomains → find dangling CNAMEs → confirm the provider is claimable → prove control safely → report before abusing users.
The pattern
shop.example.comCNAMEs tosomething.herokuapp.com- The Heroku app was deleted
- DNS was never cleaned up
- You create a new Heroku app with that name
- You now serve content on
shop.example.com
Providers change over time. The pattern stays the same: dangling DNS + claimable external host.
A calm hunting workflow
1) Enumerate
Use your usual passive sources first. Keep a clean list of subdomains in scope.
2) Resolve and classify
Note CNAMEs to common platforms (cloud storage websites, PaaS hosts, support desks, etc.).
3) Fingerprint “dangling”
Look for provider-specific error pages that say the resource is missing — not merely “blocked.”
4) Confirm claimability carefully
Only claim resources when the program allows takeover testing. Prefer a harmless proof page with your handle and a timestamp.
5) Stop at proof
Do not phish real users. Do not steal cookies “for fun.” Proof of control is enough.
Impact framing that sounds adult
Explain who trusts the subdomain:
- Cookie domain scope
- OAuth redirect allowlists
- Password reset links
- Corporate branding / support flows
Severity depends on that context. Be honest.
Fixes to recommend
- Inventory DNS continuously
- Delete dangling records when services are retired
- Prefer provider verification challenges that prevent casual claiming
- Monitor for takeover fingerprints
Original Bugflare article. Classic takeover research has been widely documented by Detectify Labs and many public bounty writeups. Follow each program’s rules on claiming third-party resources.