Subdomain Takeover

When a subdomain's CNAME points to a third-party service (a hosting platform, a SaaS tool) that was later deprovisioned without also removing the DNS record, an attacker who claims that same resource on the third-party service can serve their own content under your trusted domain.

The DNS record isn't the vulnerability by itself — it's the combination of a dangling record plus a third-party service that lets anyone register the now-unclaimed resource name

A subdomain like assets.flowground.dev pointing at a decommissioned hosting platform project inherits every ounce of trust that assets.flowground.dev has ever earned — cookies scoped to the parent domain, CSP allowlist entries, user trust in the URL bar

This is a classic finding in bug bounty programs precisely because it's easy to miss — decommissioning a service is an infrastructure task, and removing the DNS record is often a separate, easily-forgotten step

Automated scanning for dangling CNAMEs (checking every subdomain against the deprovisioning-detection signatures third-party services expose) is the standard way this class of bug is found, both by attackers and by defenders

Want this flow explained in detail as it plays?

GET/ (DNS lookup for assets.flowground.dev)

Headers

Host:assets.flowground.dev

Body

Quick-Insert Payloads

Defense in depth

Remove the DNS record as an explicit, mandatory step of decommissioning any service or hosted project — treat it as part of the same checklist, not a separate cleanup task that can be deferred
Regularly audit every DNS record for the domain and flag any CNAME pointing at a third-party service, to check whether that resource is still actually claimed and owned
Scope cookies as narrowly as possible (avoid Domain=.flowground.dev when a subdomain-specific cookie would do) so a compromised subdomain doesn't automatically inherit access to session cookies meant for the main application

Vulnerable vs. Fixed

# Decommissioning checklist (incomplete) — deletes the hosted project but leaves DNS untouched
paas-cli delete-project decommissioned-project
# DNS record for assets.flowground.dev still CNAMEs to decommissioned-project.some-paas-provider.com