# Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.

Dangling DNS for api.legalrobot.com pointed at Modulus.io; researcher claimed the wildcard *.legalrobot.com and served content with valid SSL.

- Payout: hidden
- Severity: high
- Program: Legal Robot
- Found by: fransrosen
- Disclosed: 2016-08-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/148770
- Library page: https://bugbountylibrary.com/r/h1%3A148770
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Dangling DNS record pointing to Modulus.io PaaS
**Root cause:** api.legalrobot.com DNS pointed to Modulus.io where no app was registered, so anyone could claim the hostname; the wildcard *.legalrobot.com was also claimable.
**Steps:**
1. Resolve `api.legalrobot.com` and observe Modulus.io response `NO APPLICATION WAS FOUND FOR api.legalrobot.com`
2. Create a Modulus.io account and app; attempt to add `api.legalrobot.com` (rejected as already added)
3. Add wildcard `*.legalrobot.com` to the app, which succeeds
4. Confirm takeover: `curl https://api.legalrobot.com` returns `Hello World!<!--FRANS ROSEN-->` with Modulus-issued SSL
**How found:** Noticed the Modulus.io 'no application found' page on a Legal Robot subdomain, then tested claiming the exact hostname and, when blocked, the wildcard.
**Exploitation:** Attacker registers the dangling hostname/wildcard on Modulus.io and serves arbitrary content over HTTPS on the victim's subdomain, enabling phishing, cookie theft or malware hosting under a trusted origin.
**Insight:** When a PaaS returns 'no application found' for a hostname, try claiming the wildcard apex pattern too — providers often allow wildcard claims even when the exact host is reserved.