{"id":499,"date":"2025-08-07T15:21:30","date_gmt":"2025-08-07T13:21:30","guid":{"rendered":"https:\/\/bergee.it\/blog\/?p=499"},"modified":"2026-04-27T22:18:25","modified_gmt":"2026-04-27T20:18:25","slug":"subdomain-takeover-easy-150-for-five-minute-of-work","status":"publish","type":"post","link":"https:\/\/bergee.it\/blog\/subdomain-takeover-easy-150-for-five-minute-of-work\/","title":{"rendered":"Subdomain takeover &#8211; easy $150 for five minutes of work"},"content":{"rendered":"<p>Hello<\/p>\n<p>The title might have been clickbait but it is not. I started from recon and discovered as many subdomains as possible of the <strong>target.com<\/strong> company. Then I used <a href=\"https:\/\/github.com\/projectdiscovery\/dnsx\">dnsx<\/a> tool to check all\u00a0 NXDOMAINS which have CNAME records. Among them I found the subdomain pointing to <strong>cloudapp.azure.com<\/strong> domain, which looked like this:<\/p>\n<blockquote><p>dev.target.com 600 IN CNAME devexamplename.eastus.cloudapp.azure.com.<\/p><\/blockquote>\n<p>I logged into the MS Azure portal and created the virtual machine service, then entered <strong>devexamplename<\/strong> as the name of virtual machine and selected the <strong>East US<\/strong> region&#8230; and the green tick has appeared :), pointing that I probably can takeover this domain. The best part is the company clearly stated in bug bounty policy: &#8220;If you find subdomain takeover, DO NOT take over it, just send us the proof&#8221;.<\/p>\n<p>So I took the screenshot of the Azure panel, sent the report and cashed out $150.<\/p>\n<p>See you next bug \ud83d\ude42<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello The title might have been clickbait but it is not. I started from recon and discovered as many subdomains as possible of the target.com company. Then I used dnsx tool to check all\u00a0 NXDOMAINS which have CNAME records. Among them I found the subdomain pointing to cloudapp.azure.com domain, which looked like this: dev.target.com 600&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,32,29],"tags":[],"class_list":["post-499","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii","category-bug-bounty","category-write-up"],"_links":{"self":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/comments?post=499"}],"version-history":[{"count":8,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/499\/revisions"}],"predecessor-version":[{"id":507,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/499\/revisions\/507"}],"wp:attachment":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/media?parent=499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/categories?post=499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/tags?post=499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}