# Subdomain Takeover leading to Full Account Takeover

Dangling CNAME to azurewebsites.net let attacker claim test subdomain and harvest shared ASP.NET session cookies, taking over any user's account.

- Payout: $3,000
- Severity: critical
- Program: -
- Credited: Hacktus, DreyAnd
- Disclosed: 2023-05-08
- Write-up quality: 6/10
- Original: https://hacktus.tech/subdomain-takeover-leading-to-full-account-takeover
- Library page: https://bugbountylibrary.com/r/blog%3Ahacktus-tech-subdomain-takeover-leading-to-full-account-takeover
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:critical tech:azure technique:chained technique:recon vuln:account-takeover vuln:subdomain-takeover

**Target:** Azure App Service subdomain (test.redacted.com) with shared ASP.NET Core session cookie
**Root cause:** test.redacted.com CNAME pointed to an unclaimed test-redacted.azurewebsites.net, allowing the attacker to register that Azure site and serve content on the trusted subdomain. The AspNetCore.Cookies session cookie was scoped to the parent domain and shared across all subdomains.
**Steps:**
1. `dig test.redacted.com` shows CNAME to test-redacted.azurewebsites.net returning NXDOMAIN
2. Register/claim test-redacted.azurewebsites.net in Azure App Service
3. Visit test.redacted.com and observe incoming requests logging the shared AspNetCore.Cookies cookie
4. Lure any logged-in user to test.redacted.com/ to capture their session cookie
5. Replay captured cookie to impersonate the victim
**How found:** While logged in on the main domain, noticed AspNetCore.Cookies was sent to every subdomain. Hypothesized that any subdomain takeover would yield session cookies, then hunted subdomains and found test.redacted.com dangling on Azure.
**Exploitation:** Attacker claims the dangling Azure website, then sends victims a link to test.redacted.com. Because the ASP.NET Core session cookie is shared across all subdomains, the victim's authenticated cookie is sent to the attacker-controlled host and logged, enabling session hijack and full account takeover.
**Escalation:** Chained a medium/high subdomain takeover into critical account takeover by recognizing the shared parent-domain session cookie, raising impact from STO to ATO.
**Insight:** Check cookie Domain scope on the main app; if session cookies are shared across subdomains, any dangling subdomain (CNAME to cloud PaaS like azurewebsites.net) becomes an ATO primitive, not just a defacement.