# Subdomain takeover #4 at info.hacker.one

Unbounce page URL update endpoint accepted arbitrary page[url] domain, letting attacker claim info.hacker.one subdomain via dangling DNS.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: ak1t4
- Disclosed: 2017-06-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/220002
- Library page: https://bugbountylibrary.com/r/h1%3A220002
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:incomplete-fix technique:source-review vuln:access-control vuln:subdomain-takeover

**Target:** UnbouncePages app page URL update endpoint
**Root cause:** The page URL update endpoint /[account-id]/pages/[page-id]/url accepted a page[url] parameter allowing arbitrary external domains, bypassing the prior fix for the earlier takeover report.
**Steps:**
1. Login to Unbounce account
2. Create a New Page under any domain
3. Go to 'Change URL' and fill any input
4. Intercept request with Burp
5. Change endpoint to `/[account-id]/pages/[page-id]/url`
6. Append `&page%5Burl%5D=info.hacker.one/testing-new-takeover-04-10-17` to body
7. Send POST; page now serves content at info.hacker.one
**How found:** Researcher reviewed the fix for prior report #217358 and found a new endpoint+param combination (page[url]) that still allowed arbitrary domain assignment.
**Exploitation:** Attacker sets page[url] to the victim subdomain, causing Unbounce to serve attacker-controlled content on info.hacker.one, enabling phishing/fake login pages.
**Insight:** When a vendor patches a takeover by blocking one endpoint/param, enumerate sibling endpoints (e.g. /url update) and alternate parameter names (page[url] vs page[domain]) that reach the same domain-binding logic.