Post cover image

August 16, 2026

Subdomain Takeover: A Real Bug I Found👾️

Introduction:

By Kido

2 min read

Introduction:

During a bug bounty engagement on a program (details anonymized — I'll refer to the company as XYZ Company), I found a subdomain pointing to Mailgun that no one had claimed — so I claimed it myself. In this post, I'll walk you through how I found it, confirmed it, and reported it.

Let's dive in. :)

What Is a Subdomain Takeover?

A subdomain takeover occurs when a subdomain points to an external service that has been deleted, expired, or misconfigured, yet the DNS entry still exists. If an attacker can claim that external resource, they can serve content directly from the victim's subdomain.

Recon Phase:

I started with large-scale subdomain enumeration — running multiple tools to maximize coverage, then merging and deduplicating the results into a single clean list. From there, I ran the list through Nuclei templates and Subzy to flag subdomains that showed signs of being vulnerable to takeover.

Nuclei Tool:

nuclei -list all_subdomains.txt -t /home/kido/nuclei-templates/http/takeovers/ -rl 30 -c 30 -timeout 10 -retries 2 -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" -stats

Subzy Tool:

subzy run --targets all_subdomains.txt --hide_fails --verify_ssl

Both flagged email.sub.xyzcompany.com as a potential takeover candidate.

Manual Verification:

Before trusting the automated results, I manually confirmed the CNAME with dig:

dig email.sub.xyzcompany.com CNAME

;; ANSWER SECTION:
email.sub.xyzcompany.com.  300  IN  CNAME  mailgun.org.

This confirmed the subdomain was pointing to Mailgun's infrastructure but wasn't tied to an active, claimed account — a classic dangling CNAME setup.

None

Claiming:

I created a free Mailgun account and attempted to add email.sub.xyzcompany.com as a sending domain. Normally, Mailgun blocks this with a "domain already exists" or ownership-conflict error if it's tied to an active account. In this case, it added successfully to my account — confirming the subdomain was unclaimed and takeover-able.

None

Reporting & Triage:

I reported the issue to the company, explaining that I was able to successfully add their subdomain to my own Mailgun account. The team reviewed it, confirmed the issue, and rewarded me with a Bounty.

Conclusion:

That's how I found and confirmed a subdomain takeover vulnerability — and earned a bounty for it.

Disclaimer

The content provided in this article is for educational purposes only. Always ensure you have proper authorization before conducting security assessments. Use this information responsibly

Thanks for reading and if you found this helpful, don't forget to clap! 🙌