# [engineering.udemy.com] - Subdomain Takeover (ghost.io)

Dangling CNAME from engineering.udemy.com to an unclaimed ghost.io publication let the researcher register the same slug and serve arbitrary content on Udemy's subdomain.

- Payout: hidden
- Severity: low
- Program: Udemy
- Found by: kazan71p
- Disclosed: 2018-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/368119
- Library page: https://bugbountylibrary.com/r/h1%3A368119
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** DNS CNAME to ghost.io hosted blog
**Root cause:** engineering.udemy.com CNAME pointed to udemy-engineering-blog.ghost.io, a Ghost publication that no longer existed, leaving the hostname claimable by anyone who registers that slug.
**Steps:**
1. `host engineering.udemy.com` shows alias to `udemy-engineering-blog.ghost.io`
2. Visit https://engineering.udemy.com and observe the Ghost 'site doesn't exist' page
3. Register a Ghost PRO account ($20/month) and create a publication named `udemy-engineering-blog`
4. Configure the custom domain for the publication; existing CNAME passes validation and SSL is issued
5. Serve arbitrary content at https://engineering.udemy.com/
**How found:** Noticed the subdomain resolved to a ghost.io alias and returned a 'site doesn't exist' page, indicating an unclaimed third-party publication.
**Exploitation:** Register the matching Ghost publication slug, bind the custom domain, and Ghost's validation/SSL issuance completes because the CNAME already exists, granting full content control over the subdomain.
**Insight:** Ghost (and similar SaaS blog platforms) key publications by a globally unique slug; if a CNAME still points at a deleted publication's slug, re-registering that exact slug reclaims the hostname.