# EC2 Takeover at turn.shopify.com

Dangling A record for turn.shopify.com pointed to a terminated EC2 IP; researchers re-registered that IP and served content from the Shopify subdomain.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: 0xd0m7
- Disclosed: 2022-03-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1295497
- Library page: https://bugbountylibrary.com/r/h1%3A1295497
- Tags: area:cloud domain:cloud impact:integrity kind:bounty platform:hackerone sev:low tech:aws technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** turn.shopify.com DNS A record / EC2 elastic IP
**Root cause:** DNS A record for turn.shopify.com was left pointing at an EC2 IP after the instance was terminated, and the IP was released back to AWS's pool.
**Steps:**
1. `dig turn.shopify.com` returns A record 54.90.1.144
2. Confirm the IP is no longer owned by Shopify (instance terminated)
3. Launch a new EC2 instance and associate/allocate the same IP 54.90.1.144
4. Serve content on port 80; visit `http://turn.shopify.com/0xd0m7` to confirm control
**How found:** Noticed the subdomain resolved to an EC2 IP; hypothesized the instance was terminated without DNS cleanup, then verified by re-acquiring the same IP.
**Exploitation:** Attacker allocates the released EC2 IP, binds it to their own instance, and serves arbitrary content (phishing, XSS, malware) under the trusted shopify.com subdomain; could also obtain TLS certs and run SSH/FTP to harvest credentials.
**Escalation:** Potential to add HTTPS via cert issuance, host SSH/FTP for credential sniffing, or use stored XSS for account takeover; not demonstrated.
**Insight:** Dangling A records to cloud elastic IPs are as exploitable as dangling CNAMEs; check subdomains resolving to cloud provider IP ranges and test whether the IP can be re-allocated.