# Subdomain takeover at info.hacker.one

Dangling CNAME from info.hacker.one to app.unbounce.com let researcher claim the domain via an Unbounce API flaw and serve attacker content.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: ak1t4
- Disclosed: 2017-03-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/202767
- Library page: https://bugbountylibrary.com/r/h1%3A202767
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:recon vuln:subdomain-takeover

**Target:** Subdomain info.hacker.one with CNAME to app.unbounce.com
**Root cause:** info.hacker.one had a CNAME pointing to Unbounce's app.unbounce.com but the domain was not claimed in Unbounce; Unbounce's API allowed claiming any domain whose DNS pointed to unbouncepages.com, bypassing the 'already claimed' block.
**Steps:**
1. Resolve info.hacker.one and observe CNAME to app.unbounce.com (unbouncepages.com).
2. Attempt to claim the domain in Unbounce; note the service blocks already-claimed domains.
3. Exploit an API flaw in Unbounce to claim info.hacker.one despite the block.
4. Publish a page at `http://info.hacker.one/blank-page-123133617adasdasdsa/` showing an alert box as PoC.
**How found:** While testing Unbounce page services, noticed claimed domains are blocked, went deeper and found an API 0day allowing claiming any domain with DNS pointing to unbouncepages.com.
**Exploitation:** Attacker controls content served on info.hacker.one, enabling fake HackerOne login forms to phish credentials or card data from teams.
**Escalation:** Researcher claims the Unbounce API flaw affects all Unbounce customers' domains, not just HackerOne.
**Insight:** When a takeover target's provider blocks already-claimed domains, probe the provider's claim API directly for logic flaws rather than assuming the block is authoritative.