# Subdomain Takeover: Yet another Starbucks case

Dangling CNAME from wfmnarptpc.starbucks.com to an unclaimed Azure Traffic Manager profile let the researcher register the profile and serve content on the Starbucks subdomain.

- Payout: $2,000
- Severity: medium
- Program: Starbucks
- Credited: Patrik Hudak
- Disclosed: 2018-08-09
- Write-up quality: 6/10
- Original: https://0xpatrik.com/subdomain-takeover-starbucks-ii/
- Library page: https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks-ii
- Tags: domain:cloud impact:integrity kind:bounty platform:blog sev:medium tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** DNS subdomain wfmnarptpc.starbucks.com with CNAME to trafficmanager.net
**Root cause:** Subdomain CNAME pointed to a deleted Azure Traffic Manager profile (s00149tmppcrpt.trafficmanager.net); Azure does not verify domain ownership when a profile name is re-registered.
**Steps:**
1. `dig a wfmnarptpc.starbucks.com` returns NXDOMAIN with CNAME to `s00149tmppcrpt.trafficmanager.net`
2. Confirm the trafficmanager.net profile name is unclaimed
3. Create a new Azure Traffic Manager profile with the exact name `s00149tmppcrpt`
4. Point the profile endpoint to an attacker-controlled server
5. Configure a virtual host for `wfmnarptpc.starbucks.com` on that server
6. Verify the Starbucks subdomain now resolves and serves attacker content
**How found:** Noticed NXDOMAIN on a Starbucks subdomain and, from prior experience that Azure uses dedicated IPs, checked the CNAME; a CNAME to trafficmanager.net returning NXDOMAIN signaled a likely takeover.
**Exploitation:** Researcher registered the dangling Azure Traffic Manager profile name, directed it to a server they owned, and configured the vhost, gaining full control of content served on the Starbucks subdomain.
**Insight:** Treat NXDOMAIN on a hostname that still has a CNAME to a cloud PaaS domain (trafficmanager.net, cloudapp.azure.com, etc.) as a takeover candidate; Azure Traffic Manager profile names can be re-registered without ownership verification.