Chaining a takeover into cookie theft

A subdomain takeover happens when a DNS record still points at a service the organisation no longer owns — a deprovisioned bucket, a cancelled app, a removed CDN configuration. Whoever registers that service next controls a hostname the organisation still vouches for.

This lab: Chaining a takeover into cookie theft. Claim a dangling DNS record that points at an unclaimed host.

Work it against your own copy of the target. When you have the flag, submit it below.

Find a subdomain whose DNS points at an unclaimed service, identify the platform, and demonstrate that you could serve content from it. Capture the flag confirming the takeover.