Did I Properly Identify Potential Subdomain Takeovers?

[thakillingjoke]

I’m still learning, and I think this is the furthest I’ve gotten with something like this, so I’d really appreciate some validation and explanation from people with more experience.

I’m not entirely sure what the practical impact/value of these findings would be, and I’m not looking to take any of the domains further or actually execute a takeover. What I am trying to do is understand the vulnerability better—specifically, how a dangling CNAME can become an actual subdomain takeover, what would need to be demonstrated to establish that conclusively, and what the potential impact could be after a takeover is legitimately established. My goal is to learn the methodology and improve my understanding and experience.

Below is a partially redacted evidence chain showing the type of evidence I’ve collected. I can provide the unredacted evidence privately if needed.

I originally identified 48 dangling CNAMEs. Of those, 11 returned nameAvailable: true when I checked the corresponding Azure Traffic Manager DNS prefixes.

I’m mainly looking for feedback on whether my interpretation is correct, what additional evidence would be required to classify these as confirmed takeover vulnerabilities, and how the potential impact should be documented in a bug-bounty report.

Any constructive feedback or explanation would be appreciated.

Evidence Chain:

thakillingjoke@ThaKillingJoke:~/***********/results/************$ dig +noall +answer ven*****.cld.************.com CNAME
ven*****.cld.************.com. 10028 IN CNAME prod-sa**-ven*****ddy.trafficmanager.net.

thakillingjoke@ThaKillingJoke:~/***********/results/************$ dig prod-sa**-ven*****ddy.trafficmanager.net

; <<>> DiG 9.20.27-2-Debian <<>> prod-sa**-ven*****ddy.trafficmanager.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23752
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;prod-sa**-ven*****ddy.trafficmanager.net. IN A

;; AUTHORITY SECTION:
trafficmanager.net. 25 IN SOA tm1.dns-tm.com. hostmaster.trafficmanager.net. 2003080800 900 300 2419200 30

thakillingjoke@ThaKillingJoke:~/***********/results/************$ dig @tm1.dns-tm.com prod-sa**-ven*****ddy.trafficmanager.net

; <<>> DiG 9.20.27-2-Debian <<>> prod-sa**-ven*****ddy.trafficmanager.net
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37110
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;prod-sa**-ven*****ddy.trafficmanager.net. IN A

;; AUTHORITY SECTION:
trafficmanager.net. 30 IN SOA tm1.dns-tm.com. hostmaster.trafficmanager.net. 2003080800 900 300 2419200 30

thakillingjoke@ThaKillingJoke:~/***********/results/************$ az network traffic-manager profile check-dns -n prod-sa**-ven*****ddy -o json
{
"name": "prod-sa**-ven*****ddy",
"nameAvailable": true,
"type": "Microsoft.Network/trafficManagerProfiles"
}

 

[NinjaNet]

first of all if you do this bounty for any program on clearnet like HackerOne you already break her rule because you share your Recon data with other people.

Subdomain take over no need a proof more than do a simple redirect via cname record to your own domain or fake url or just simply upload a html file thats show the domain take over its depend on the bug like you redirect him or just upload a html or website content on this,in bug bounty you can simply redirect the sub domain to the program main website domain or use a google.com or upload a simple html file thats have some message like sub domain take over it or else ,no more than this because its put you into trouble,Dont touch any thing just show a normal or basic impact thats full POC for them depend on the program rule,Also your output of your recon is unclear can you redirect the domain to your domain or can you use the cname record on your own server thats can response from your own server or show your poc html page if yes then jackpot its take over impact & report him.

on your report make sure you have POC of step by step,Dont mention if you use any auto scanner because it will be rejected also take a screen record video about how you do it they dont want your recon they just want where & how will be happen just record this part & include the POC video on your report