# Sub-domain Takeover on api.techprep.fb.com (AWS Elastic Beanstalk)!

Dangling CNAME on api.techprep.fb.com pointed to a deleted Elastic Beanstalk host, letting any AWS user claim it and take over the subdomain.

- Payout: $500
- Severity: medium
- Program: Meta / Facebook
- Credited: Binit Ghimire
- Disclosed: 2021-02-16
- Write-up quality: 6/10
- Original: https://publish.whoisbinit.me/subdomain-takeover-on-api-techprep-fb-com-through-aws-elastic-beanstalk
- Library page: https://bugbountylibrary.com/r/blog%3Apublish-whoisbinit-me-subdomain-takeover-on-api-techprep-fb-com-through-aws-elastic-beanstalk
- Tags: domain:cloud impact:integrity kind:bounty platform:blog sev:medium tech:aws technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** api.techprep.fb.com DNS CNAME to AWS Elastic Beanstalk
**Root cause:** Facebook deleted the techprep-backend Elastic Beanstalk instance in us-east-1 but left the CNAME from api.techprep.fb.com pointing to techprep-backend.us-east-1.elasticbeanstalk.com, which no longer resolved.
**Steps:**
1. `dig api.techprep.fb.com` shows CNAME to `techprep-backend.us-east-1.elasticbeanstalk.com`
2. `nmap -sV -O techprep-backend.us-east-1.elasticbeanstalk.com -Pn` fails to resolve, confirming dangling record
3. Enumerate fb.com subdomains with assetfinder/subfinder/sublist3r/amass, then `dig +short $domain | grep elasticbeanstalk` to flag candidates
4. Register an Elastic Beanstalk app named `techprep-backend` in us-east-1 to claim the hostname and serve content via api.techprep.fb.com
**How found:** Fully automated Bash workflow: aggregate subdomains from multiple enumerators, then loop `dig +short` over each and grep for 'elasticbeanstalk' to surface CNAMEs pointing at AWS EB; manual nmap confirmed the target did not resolve.
**Exploitation:** Attacker with an AWS account creates an Elastic Beanstalk instance named techprep-backend in us-east-1, reclaiming the dangling hostname; the CNAME then resolves to attacker-controlled content served under api.techprep.fb.com.
**Insight:** Grep subdomain CNAMEs for cloud PaaS hostnames (elasticbeanstalk, herokuapp, azurewebsites, cloudfront) and verify non-resolution; PaaS names are globally claimable by anyone in the same region, so a deleted backend leaves the DNS record hijackable.