# Subdomain takeover #3 at info.hacker.one

Unbounce page-update endpoint accepted a page[url] param, letting an attacker claim info.hacker.one and host content on the subdomain.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: ak1t4
- Disclosed: 2017-06-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/217358
- Library page: https://bugbountylibrary.com/r/h1%3A217358
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:incomplete-fix vuln:access-control vuln:subdomain-takeover

**Target:** Unbounce Pages app page-update endpoint (app.unbounce.com)
**Root cause:** The page update endpoint accepted an undocumented page[url] parameter that set the page's custom domain, bypassing the earlier fix for the prior takeover report.
**Steps:**
1. Log in to Unbounce and create a new page under any domain
2. Open 'EDIT NAME' and fill any input
3. Intercept the update request with a proxy
4. Add body param `&page%5Burl%5D=info%2ehacker%2eone%2Ftakeover-bypass-by-ak1t4` to the POST /[account-id]/pages/[page-id] request
5. Refresh page; the claimed domain appears as the page URL
6. Visit https://info.hacker.one/new-awesome-takeover/ to confirm attacker content served
**How found:** Researcher revisited the prior subdomain takeover report (209004) and its fix, then fuzzed the page-update request for other parameters, discovering page[url] still allowed setting the custom domain.
**Exploitation:** Attacker sets page[url] to the victim subdomain via the page-update request, causing Unbounce to serve attacker-controlled page content on info.hacker.one, enabling phishing/fake login forms and credential theft.
**Escalation:** Same param affects all branded domains/customers on unbouncepages.com.
**Insight:** After a takeover fix, re-test the same object-update endpoint for sibling mass-assignment params (e.g. page[url]) that still bind the custom-domain field; the fix often only blocks the originally reported param.