How do I take over another user subdomain name worth $$$$

Hello everyone

I would like to write down a finding regarding the takeover of another user’s Subdomain name. Previously I explained a little about how this website works.

So, the website that I’m testing has a feature to set each Subdomain name the same as Shopify
Users can change their subdomain name to another name, of course, they cannot change the subdomain name to one that already exists or is used by another user.

In touch I’m not allowed to mention the name of their company so we’ll call it REDACTED.COM (Actually they let me share my findings but waited until June 1st, so I’ll upload these findings later on my channel )

How can I take over another user’s subdomain name? As usual, I did a test on several features but found nothing, the feature that caught my attention was setting the Subdomain Name, users can change each subdomain name as follows

Settings subdomain name

Like the image above Attacker is my Subdomain name, and it will look like what if I change the subdomain name to another user’s Subdomain name? I try to do it then the response will look like the following “REDACTED Page URL has already been taken”

Subdomain already been taken

So I tried adding SPACE at the end of the subdomain name, and it’s very surprising. I managed to change my Subdomain name to another user’s Subdomain name.

Yep that’s right, I added a SPACE at the end of the subdomain name:p or with the following URL encode %20 on the Burp Suite request as follows

The parameters “campaign[redacted_slug]” and “victim%20” are the subdomain name of the victim by adding space with the URL encoding, see the image below

Request & respons

Response “202 Accepted” that I managed to change my subdomain name to the victim’s Subdomain name, the previous Subdomain name successfully changed to the victim Subdomain name

I immediately reported my findings to their Team after 2 days of waiting for them to reply to my email, that the findings were valid and I was given a bounty of $1250

Bounty awarded

Thank you for reading my writing, stay focused on your program and test all available features, don’t miss any little things.

You can see my other findings here [Bahasa]

If you like my findings, give me a round of applause 👏 And ignore if there are wrong writing words



Follow me at | Blog

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store