# Subdomain Takeover using blog.greenhouse.io pointing to Hubspot

Dangling DNS record for blog.greenhouse.io pointed to an expired Hubspot account, letting anyone claim the subdomain and host phishing/XSS content on a greenhouse.io origin.

- Payout: hidden
- Severity: high
- Program: Greenhouse.io
- Found by: fransrosen
- Disclosed: 2015-02-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/38007
- Library page: https://bugbountylibrary.com/r/h1%3A38007
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:subdomain-takeover vuln:xss

**Target:** Dangling DNS CNAME to Hubspot (blog.greenhouse.io)
**Root cause:** blog.greenhouse.io CNAME'd to Hubspot, but the Hubspot account was expired/cancelled, leaving the hostname claimable by any Hubspot user.
**Steps:**
1. Resolve `host blog.greenhouse.io` and observe CNAME chain to `san.secure001.hubspot.com.edgekey.net` / `e1395.b.akamaiedge.net`.
2. Recognize the Hubspot account behind the hostname is expired/cancelled.
3. Claim the hostname in a Hubspot account to serve attacker content at blog.greenhouse.io.
4. Host a fake greenhouse.io login form / JS on the claimed subdomain.
**How found:** DNS recon of subdomains revealed a CNAME to Hubspot; checking the target showed the backing account was unclaimed, indicating a takeover.
**Exploitation:** Attacker claims the dangling Hubspot hostname, then serves arbitrary HTML/JS at blog.greenhouse.io, enabling credential phishing and malware distribution from a trusted greenhouse.io origin.
**Insight:** Enumerate subdomains and resolve CNAMEs to third-party SaaS (Hubspot, Heroku, GitHub Pages); a dangling record to an expired/unclaimed account is claimable — verify by actually claiming it for PoC.