Sudomain Takeover via Shopify(Easy Bounty $$$$)

Hey guys, in this blog I will explain how Subdomain takeover via Shopify works. Have Fun reading ; )

A subdomain takeover is a vulnerability that occurs when a subdomain of a website points to a service (e.g., a hosting platform, a Content Delivery Network — CDN, or another third-party service) that the domain owner no longer uses or controls. If an attacker can gain control over the service or resource linked to the subdomain, they can essentially take over the subdomain and use it for malicious purposes.

How Subdomain Takeover via Shopify works?

The vulnerability exists in the way that Shopify handles DNS records for subdomains.
Specifically, if a store owner adds a custom subdomain to their Shopify store, but later removes it without deleting the associated DNS record, an attacker could potentially register that subdomain and take control of it.

How to look for potential vulnerable subdomain?

2. ) use Subfinder or virustotal to enumerate the subdomain

3. ) use httpx or httpstatus to enumerate the http status code and look for 404 status code ( 404 = potential vulnerable to subdomain takeover )

4. ) Check every 404 output and manually look for something like this

5. ) After that, go to shopify and if you are new, then create a free account

6. ) Then go to settings, and click domains

7. ) in the domains click “Connect existing domain”

8. ) Then enter the vulnerable subdomain and click next.

9. ) after you connect the existing domain click “Verify connection”

10.) Boom!!! Subdomain Takeove Successfully