bug-bounty431
xss283
google261
microsoft220
facebook194
apple141
rce139
malware103
exploit101
bragging-post94
account-takeover93
cve79
csrf77
authentication-bypass67
privilege-escalation62
access-control53
phishing51
dos49
defi48
smart-contract47
supply-chain46
browser45
ssrf44
cloudflare44
writeup44
ethereum44
open-source43
stored-xss42
sql-injection41
web339
input-validation37
web-security37
aws37
docker36
reverse-engineering35
ai-agents35
react34
api-security34
oauth33
smart-contract-vulnerability33
cross-site-scripting33
burp-suite32
reflected-xss32
information-disclosure31
idor31
race-condition30
node30
denial-of-service29
web-application28
clickjacking26
0
3/10
bug-bounty
Security researcher Ali Razzaq identified and exploited a subdomain takeover vulnerability on a Netlify-hosted subdomain by discovering an unclaimed CNAME record pointing to Netlify and registering the subdomain through Netlify's custom domain feature, earning a $200 bounty.
Ali Razzaq
Netlify
findsubdomains.com
0
6/10
Researchers identified and documented a method to discover and exploit over 55,000 subdomain takeover vulnerabilities on Shopify by analyzing FDNS datasets for CNAMEs pointing to Shopify infrastructure, then claiming unclaimed shop names to hijack subdomains. They developed a script with improved false-positive detection using page error messages, CNAME verification, and REST API checks.
subdomain-takeover
dns-misconfiguration
shopify
cloud-security
large-scale-vulnerability
cname-hijacking
bug-bounty
reconnaissance
automation
bragging-post
Shopify
FDNS dataset
Project Sonar
buckhacker
HackerOne