Subdomain takeover due to improper records

Question

INTRO

On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too.

QUESTION

I found a snapchat (sc-cdn.net) domain which is pointing to Fastly, let's say it is fastly.sc-cdn.net. However, when I try to register it on Fastly, Fastly won't allow it and gives the following error

Domain 'sc-cdn.net' is already taken by another customer.

So, that got me wondering how the user ebrietas succeeded in registering the domain as explained in the following Hackerone report below. Could it be because snapchat 'unclaimed' sc-cdn.net at that particular moment? Because that seems illogical and not likely to me, but if that is not the case; how could one succeed in registering it?

THE REPORT (AGAIN)

https://hackerone.com/reports/154425

OUTRO

Even if it seems impossible to register right now, it, of course, still is a bug since it could be abused in the future when the domain is 'unclaimed' or by abusing a Fastly bug; but does someone know how to register such a domain on Fastly.net? I am very curious. Trial subscription on Fastly.com is free by the way, might help. Thanks in advance folks!

Answer 1

Snapchat had this Fastly instance set up, but eventually cancelled their service. However, they had forgotten to remove the DNS record, which allowed this researcher to simply to register a new Fastly instance with this name.

It's obviously not vulnerable anymore because they either removed the DNS record or just registered their Fastly instance again.

Domain 'sc-cdn.net' is already taken by another customer.

This means you obviously can't register it / take it over.