PentestBro - Combines Subdomain Scans, Whois, Port Scanning, Banner Grabbing And Web Enumeration Into One Tool

Experimental tool for Windows. PentestBro combines subdomain scans, whois, port scanning, banner grabbing and web enumeration into one tool. Uses subdomain list of SecLists. Uses nmap service probes for banner grabbing. Uses list of paths for web enumeration. Examplescan of "www.ccc.de": Scanned...

U.S. Dept Of Defense: CSRF Based XSS @ https://██████████

Summary: Good Afternoon Team, I recently discovered subdomain https://██████████/█████████ from a POST Based XSS which when combined with CSRF allows for seemless XSS. ███ HTTP Request POST /██████ HTTP/1.1 Host: █████████ Connection: close Content-Length: 619 Cache-Control: max-age=0 sec-ch-ua:...

The vulnerability of the Bind9 DNS server package arises from errors in processing “update-policy” rules of the “subdomain” type. This allows attackers to update all parts of the DNS zone along with the subdomain for which an update is scheduled.

The vulnerability of the Bind9 DNS server package is related to errors in processing “update-policy” rules of the “subdomain” type, such as “zoneub”. Exploiting this vulnerability allows a malicious actor to update all parts of the DNS zone, including the subdomain for which updates are scheduled...

Exploit for Cross-site Scripting in Sherlockim

CVE-2021-29267 SherlockIM ChatBot XSS Suggested description...

Subcert - An Subdomain Enumeration Tool, That Finds All The Subdomains From Certificate Transparency Logs

Subcert is a subdomain enumeration tool, that finds all the valid subdomains from certificate transparency logs. Setup Step 1: Install Python 3 apt-get install python3-pip Step 2: Clone the Repository git clone https://github.com/A3h1nt/Subcert.git Step 3: Install Dependencies pip3 install -r...

Zomato: subdomain takeover on fddkim.zomato.com

Our subdomain fddkim.zomato.com was vulnerable to a 0-day subdomain takeover vulnerability on Freshdesk. The DNS entry was removed on our end to fix this. HOW I hacked thousand of subdomains writeup--https://medium.com/@moSec/how-i-hacked-thousand-of-subdomains-6aa43b92282c...

Tennessee Valley Authority: SQL Injection on https://soa-accp.glbx.tva.gov/ via "/api/" path - VI-21-015

Summary: i've found this subdomain soa-accp.glbx.tva.gov also is vulnerable to SQLI through /api/ path Steps To Reproduce: https://soa-accp.glbx.tva.gov/api/river/observed-data/GVDA1'+%2f!50000union%2f+SELECT+HOSTNAME--+- hostname dumped...

HackerOne: Dangling cloud instance at vpn.inverselink.com

Summary: vpn.inverselink.com points to 54.202.130.246, which is currently serving a TLS certificate for Workday, Inc. This seems to indicate that the subdomain is no longer controlled by HackerOne. Optional: Supporting Material/References Screenshots % dig vpn.inverselink.com +short 54.202.130.24...

8x8: DNS Misconfiguration (Subdomain Takeover) █.staging.█.8x8.com

An EC2 instance was terminated but the DNS record was initially not updated/removed. The issue has been rectified. Same technique mentioned on https://melbadry9.medium.com/dangling-dns-aws-ec2-e2d801701e8...

CVE-2021-27231

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages...

Design/Logic Flaw

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages...

CVE-2021-27231

CVE-2021-27231 affects Hestia Control Panel 1.3.5 and below in a shared-hosting environment. The vulnerability allows remote authenticated users to create a subdomain for a different customer’s domain name, leading to spoofing of services or email messages. The provided documents describe the iss...

CVE-2021-27231

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages...

Secomea GateManager 安全漏洞

Secomea GateManager is a remote access server product from Secomea, Denmark. A security vulnerability exists in GateManager versions prior to 9.2c, which stems from an insecure direct object reference vulnerability that can be exploited by an attacker to reset the password of any user in his doma...

Hestia Control Panel Security Vulnerability

Hestia Control Panel is an open source hosting control panel. A security vulnerability exists in Hestia Control Panel through 1.3.3 that allows remote authenticated users to create subdomains for domains of different clients, resulting in spoofed service or email messages...

TikTok: Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

An unclaimed Amazon S3 bucket which no longer used for any TikTok applications and did not host any user data could have allowed a takeover on a musical.ly subdomain. We thank @daik0n for reporting this to our team...

8x8: DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com

An EC2 instance was replaced but the DNS record was initially not updated/removed. The issue has been rectified. https://medium.com/bugbountywriteup/dangling-dns-aws-ec2-e2d801701e8...

Open Redirection

github.com/oauth2-proxy/oauth2-proxy is vulnerable to open redirection. A user who enables whitelisting for subdomain checking is redirected to unintended domain. For example, if a whitelist domain includes “.example.com” to allow subdomains of example.com, “example.com” and “badexample.com” coul...

CVE-2021-21291

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

CVE-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...