# Subdomain takeover on wfmnarptpc.starbucks.com

Dangling CNAME from wfmnarptpc.starbucks.com to an unclaimed Azure Traffic Manager profile let anyone register it and serve arbitrary content on the Starbucks subdomain.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: 0xpatrik
- Disclosed: 2018-08-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/388622
- Library page: https://bugbountylibrary.com/r/h1%3A388622
- Tags: area:cloud domain:cloud impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Azure Traffic Manager CNAME on starbucks.com subdomain
**Root cause:** wfmnarptpc.starbucks.com CNAMEs to s00149tmppcrpt.trafficmanager.net, an Azure Traffic Manager profile no longer registered, so anyone can claim that profile name.
**Steps:**
1. Enumerate starbucks.com DNS and note `wfmnarptpc.starbucks.com` CNAME to `s00149tmppcrpt.trafficmanager.net`.
2. Observe the Traffic Manager profile is unregistered in Azure (dangling).
3. Register a Traffic Manager profile with the same name `s00149tmppcrpt.trafficmanager.net` in Azure portal.
4. Point it at attacker-controlled content; host `http://wfmnarptpc.starbucks.com/poc.html` as proof.
**How found:** DNS recon of starbucks.com subdomains revealed a CNAME to an Azure Traffic Manager endpoint; checking whether that profile was still registered showed it was unclaimed.
**Exploitation:** Attacker registers the dangling Azure Traffic Manager profile name, gaining full control over content served on wfmnarptpc.starbucks.com; can host malware, phishing pages, and obtain DV TLS certs since CAs like Let's Encrypt only require domain verification.
**Insight:** Azure Traffic Manager profile names are globally claimable once deleted; any CNAME to *.trafficmanager.net whose profile no longer resolves as registered is a takeover candidate, and DV cert issuance makes it HTTPS-capable.

## Proof of concept (copied exactly from the original report)

**PoC URL on taken-over subdomain**

```
http://wfmnarptpc.starbucks.com/poc.html
```