# Subdomain takeover on developer.openapi.starbucks.com

Dangling Mashery proxy on developer.openapi.starbucks.com let any trial user claim the domain and serve arbitrary content, enabling phishing and cookie theft.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: dpgribkov
- Disclosed: 2018-02-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/275714
- Library page: https://bugbountylibrary.com/r/h1%3A275714
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** developer.openapi.starbucks.com (Mashery-hosted API portal)
**Root cause:** The subdomain was still pointed at Mashery's proxy but no Mashery account had claimed the custom domain, so any trial user could add it under Portal Settings.
**Steps:**
1. Browse `http://developer.openapi.starbucks.com/`; note 200 response and `Server: Mashery Proxy` header.
2. Register and confirm a trial account at https://www.mashery.com/.
3. In the dashboard under `Portal Settings`, add `developer.openapi.starbucks.com` as your custom domain; no error returned.
4. Visit `http://developer.openapi.starbucks.com/` and observe your own welcome page is served.
5. Add `alert(document.domain)` to the Welcome page to prove content control.
**How found:** Recon on starbucks.com subdomains surfaced a 200 response with a `Server: Mashery Proxy` header, prompting the hypothesis that the Mashery custom-domain binding was unclaimed; registering a trial Mashery account and adding the domain confirmed it.
**Exploitation:** Attacker claims the dangling domain in their own Mashery portal and serves arbitrary HTML/JS under the Starbucks subdomain, usable for phishing, credential theft, or cookie/session theft.
**Insight:** A `Server: Mashery Proxy` (or similar SaaS proxy) header on a branded subdomain is a takeover signal: check whether the custom domain is still claimable in a free trial account of that SaaS provider.