# Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io

Dangling CNAME on a2.bime.io pointed to an unclaimed S3 website bucket, letting an attacker claim it and host a fake BIME login page.

- Payout: hidden
- Severity: medium
- Program: Bime
- Found by: michiel
- Disclosed: 2016-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/121461
- Library page: https://bugbountylibrary.com/r/h1%3A121461
- Tags: area:cloud domain:cloud impact:ato kind:bounty platform:hackerone sev:medium tech:aws tech:s3 technique:recon vuln:subdomain-takeover

**Target:** Dangling DNS CNAME to Amazon S3 website bucket
**Root cause:** a2.bime.io CNAME pointed to bimeio.s3-website-us-east-1.amazonaws.com, an S3 website bucket that no longer existed and could be re-registered by anyone.
**Steps:**
1. `dig A a2.bime.io @8.8.8.8` shows CNAME to `bimeio.s3-website-us-east-1.amazonaws.com`
2. Visit http://a2.bime.io and observe 404 (bucket unclaimed)
3. Create a bucket named `a2.bime.io` in US East 1 on own S3 account
4. Enable static website hosting with `index.html` as index document
5. Upload fake login `index.html` and make it public
6. Visit http://a2.bime.io to see attacker-controlled BIME login page
**How found:** Noticed BIME is built on AWS, then hunted for DNS entries still pointing at S3 buckets that no longer exist; found a2.bime.io resolved to a nonexistent S3 website bucket.
**Exploitation:** Attacker claims the dangling S3 bucket and serves a pixel-perfect clone of the BIME sign-in page on a trusted bime.io subdomain, harvesting credentials from users who click Sign In.
**Insight:** Enumerate CNAMEs to s3-website-* endpoints and check whether the bucket name is still claimable; a 404 on the subdomain confirms the takeover is available.