# Subdomain Takeover - https://competition.shopify.com/

Dangling CNAME from competition.shopify.com to unclaimed Heroku DNS let the researcher claim the subdomain and serve content on Shopify's domain.

- Payout: $750
- Severity: medium
- Program: Shopify
- Found by: llt4l
- Disclosed: 2018-06-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/365853
- Library page: https://bugbountylibrary.com/r/h1%3A365853
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Subdomain competition.shopify.com (DNS CNAME to Heroku)
**Root cause:** competition.shopify.com CNAME pointed to competition.shopify.com.herokudns.com, but the custom domain was unclaimed in Heroku, leaving the DNS record dangling.
**Steps:**
1. Resolve `competition.shopify.com` and observe CNAME to `competition.shopify.com.herokudns.com`
2. Confirm the Heroku custom domain is unclaimed (Heroku returns no-app error)
3. Create a Heroku app, add `competition.shopify.com` as custom domain
4. Upload PoC file at `/329a01fddb5a552265170b02c579c85f.html` and redirect index to shopify.com
**How found:** Noticed the subdomain resolved via a Heroku CNAME and tested whether the corresponding Heroku custom domain was still claimed.
**Exploitation:** Researcher claimed the dangling Heroku custom domain, gaining full control of content served on competition.shopify.com with valid SSL, enabling cookie theft, phishing, or malware hosting.
**Insight:** Enumerate CNAMEs to SaaS providers (Heroku, S3, GitHub Pages) and check for provider-specific 'no such app' responses; a dangling record is claimable by anyone who registers the same app name.