# Take Advantage of Out-of-Scope Domains in Bug Bounty Programs

Stored XSS on out-of-scope AnswerHub plus document.domain relaxation on in-scope Angular app let attacker read cross-origin data via framed /support/ page.

- Payout: $1,250
- Severity: medium
- Program: -
- Credited: Abdullah Hussam
- Disclosed: 2018-06-27
- Write-up quality: 7/10
- Original: https://ahussam.me/Take-Advantage-of-Out-of-Scope-Domains-in-Bug-Bounty/
- Library page: https://bugbountylibrary.com/r/blog%3Aahussam-me-take-advantage-of-out-of-scope-domains-in-bug-bounty
- Tags: domain:web impact:data-leak impact:integrity kind:bounty platform:blog sev:medium technique:chained technique:recon vuln:misconfiguration vuln:xss

**Target:** AnswerHub subdomain (answers.target.com) and Angular app developer.market.target.com
**Root cause:** AnswerHub allowed uploading XML attachments served with attacker-controlled Content-Type, enabling stored XSS; developer.market.target.com set document.domain='target.com' and /support/ lacked X-Frame-Options, so same-SLD frames could read cross-origin DOM.
**Steps:**
1. Recon with sublist3r finds answers.target.com running vulnerable AnswerHub.
2. Confirm developer.market.target.com sets `document.domain = "target.com"` in head script.
3. Find /support/ path lacks X-Frame-Options.
4. Upload `poc.xml` as attachment to answers.target.com, intercept and change `Content-Type: text/plain` to `text/xml`.
5. Visit attachment URL; script sets `document.domain='target.com'`, frames `https://developer.market.target.com/support/`, reads `contentWindow.document.getElementsByClassName('ng-binding')[3].innerText`.
**How found:** Typed `document.domain` in console on developer.market.target.com, saw it returned "target.com", then grepped source for the assignment; noticed XFO Deny blocked framing but next day found /support/ path without the header.
**Exploitation:** Attacker hosts stored XSS on out-of-scope AnswerHub, sets document.domain to shared SLD, frames in-scope /support/ page lacking XFO, and reads cross-origin DOM content and executes JS in the in-scope origin.
**Escalation:** Chained out-of-scope stored XSS with in-scope document.domain misconfiguration and missing XFO on /support/ to achieve SOP bypass and code execution on in-scope origin.
**Insight:** Check `document.domain` in console on any subdomain of a large SLD; a relaxed value plus any sibling path missing X-Frame-Options turns an out-of-scope XSS into in-scope SOP bypass.