How I Hacked Thousands of Subdomains

The tab I checked every day

Hello everyone. In March 2021, I continued hunting and invested my time in subdomain discovery and subdomain takeover. Subdomain takeover is often described as low-hanging fruit, but finding the one vulnerable hostname among a large attack surface is genuinely hard.

The can-i-take-over-xyz repository became one of the tabs I opened every day. It quickly showed whether a third-party service had a known takeover fingerprint, and I checked it whenever reconnaissance exposed a provider I had not seen before.

I also kept learning from 0xPatrik’s research, a helpful resource for understanding subdomain takeover.

Sometimes, no matter how hard you try, you simply have to keep trying.

I learned something new every day. That made me happy; failing to find a vulnerable subdomain could still be discouraging, but I did not stop.

The response that did not look right

During reconnaissance on one target, Aquatone finished taking screenshots of the discovered subdomains. As usual, I reviewed every screenshot. One response looked strange, so I dug into its DNS records with the Google Admin Toolbox.

I followed the signup link to test the claim workflow.

After signup, verification appeared to make the takeover impossible. From the browser’s point of view, that looked like the end of the path.

Curiosity became the methodology

I told myself: let us see how these requests move through Burp Suite.

One of the most important lessons for beginners is to stay curious: question everything, change things, read documentation, and keep experimenting until you understand how the system works. If you understand it, you can test it better.

When I focus on a single request, I create a hundred questions in my mind and answer each of them practically. How does the front end handle the response? What happens during response manipulation? How will the back end process a different request? What if the HTTP method changes from PUT to DELETE? What if a header changes, or the body uses a different content type? Each response reveals part of the implementation—and sometimes how to make the workflow do something it was never designed to do.

Remember being a child and breaking a toy because you wanted to see what was inside? That same instinct can be a useful research habit. Now, back to the story.

I played with the workflow for a few minutes. Then—guess what?

I was like: 😂

From one hostname to thousands

The next day, I created a fingerprint and used Subjack to search for the same condition at scale. I scanned in-scope bug-bounty assets and the historical Alexa top one million list. The same zero-day pattern appeared across thousands of subdomains.

Historical examples included subdomains belonging to dhl.com, stackoverflow.com, raspberrypi.org, avast.com, imperva.com, joebiden.com, and many other well-known sites. Again, these names document the 2021 research—not their current security posture.

I submitted more than ten reports and earned approximately $5,000 in total rewards.

The lesson: do not outsource your conclusion

The ultimate tip in this write-up is to dig deeper than others. Imagine if I had opened the can-i-take-over-xyz repository, found Freshdesk, read the existing threads, and stopped there.

The reference said the service was not vulnerable, so I would not have found the bypass. One program triager captured the significance perfectly:

“Congratulations on finding a bypass on what many people thought was not possible.”

Still learning

I am still a NOOB and learn every day. I do my best to succeed in bug bounty and ethical hacking because it is my hobby; when this happened, I had started exactly one year earlier.

I wish success to everyone on this journey. If you have questions, reach out on Twitter. Thank you for reading my first write-up.