# Subdomain takeover #2 at info.hacker.one

Unbounce page-update endpoint accepted arbitrary page[domain], letting attacker re-claim info.hacker.one after prior fix and host content on it.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: ak1t4
- Disclosed: 2017-04-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/209004
- Library page: https://bugbountylibrary.com/r/h1%3A209004
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:incomplete-fix vuln:access-control vuln:subdomain-takeover

**Target:** Unbounce Pages app page-update endpoint /[account-id]/pages/[page-id]
**Root cause:** The page update endpoint accepts a page[domain] parameter that lets a user set an arbitrary custom domain on their page, bypassing the earlier fix for the prior takeover report.
**Steps:**
1. Log in to Unbounce account
2. Create a New Page under any domain
3. Go to 'Edit Notes' and fill any input
4. Intercept the request with Burp
5. Add body params `&page%5Bdescription%5D=test&page%5Bdomain%5D=__anydomain.com__`
6. Refresh page; the new claimed domain appears on the page URL
7. Visit http://info.hacker.one/full-takeover/ to confirm takeover
**How found:** Researcher reviewed the fix for prior report 202767 and found a new vulnerable endpoint/parameter (page[domain]) that still allowed claiming arbitrary domains.
**Exploitation:** Attacker sets page[domain] to a dangling branded domain (info.hacker.one) via the page-update PUT, then serves attacker-controlled content at that subdomain, enabling phishing/fake login pages and credential theft.
**Escalation:** Affects all branded domains under Unbounce Pages, not just HackerOne's.
**Insight:** When a subdomain-takeover fix lands, re-test the same feature for alternate parameters/endpoints that still let you set the custom domain (e.g. mass-assignment of page[domain] on update).