1558 matches found
Stripo Inc: subdomain takeover at status-stage0.stripo.email
The subdomain status-stage0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it. I have parked it with an account on uptimerobot.com note : this issue is similar to report but with another...
Lyst: Subdomain takeover of storybook.lystit.com
Summary: The subdomain storybook.lystit.com had an CNAME record pointing to an unclaimed S3 bucket. This is a high severity security issue because an attacker can register the bucket on AWS and therefore can serve her own content on the subdomain. This allows for various attacks. Description: The...
The vulnerability of the CentOS Web Panel application for managing servers arises from insufficient validation of input data. This allows a malicious individual to delete a subdomain from a user account.
The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to delete a subdomain from a user’s account remotely...
8x8: Reflected xss on 8x8.com subdomain
The Beta version of a new chat API was discovered to contain a reflected XSS flaw. With the help of the researcher we were able to resolve the issue and ensure the future chat product will not contain this flaw. Write-up for beginners like me.. hackwithcommunity...
Turbolist3r - Subdomain Enumeration Tool With Analysis Features For Discovered Domains
Turbolist3r is a fork of the sublist3r subdomain discovery tool. In addition to the original OSINT capabilties of sublist3r, turbolist3r automates some analysis of the results, with a focus on subdomain takeover. Turbolist3r queries public DNS servers for each discovered subdomain. If the subdoma...
Findomain v0.9.3 - The Fastest And Cross-Platform Subdomain Enumerator
The fastest and cross-platform subdomain enumerator. What Findomain can do? It table gives you a idea why you should use findomain and what it can do for you. The domain used for the test was aol.com in the following BlackArch virtual machine: Host: KVM/QEMU Standard PC i440FX + PIIX, 1996...
python security update
2.7.5-86.0.3 - Prefix dot in domain for proper subdomain validation CVE-2018-20852Orabug: 30114725...
MTN Group: SharePoint exposed web services in a subdomain
Hi there I found a subdomain that is sharepoint configuration is poorly implemented Because of improper configuration an anonymous user can access to the SharePoint Web Services. POC: Go to the following url: https://www.mtn.co.za/vtibin/lists.asmx?WSDL services.jpg Remediation Restrict access to...
DataStax: Helpdesk Takeover at dmc.datastax.com
Summary: DNS record dmc.datastax.com is pointing to stale dmc-support.zendesk.com domain on Zendesk which is available for takeover. DNS Stale Records: F661014 Proof of Concept: There was no helpdesk configured at this address, which means that the address was available and anyone could claim it....
U.S. Dept Of Defense: Reflected Xss https://██████/
Hello security all teams Relevant Products/Components: last version Detailed Description: Reflected XSS so have high impact. Steps To Reproduce: 1-go in subdomain 2-and check url if tableau uses 3-Uses you can add this redirect dir in url with Authentication redirect:-...
python security update
2.7.5-86.0.3 - Prefix dot in domain for proper subdomain validation CVE-2018-20852Orabug: 30114725...
Nord Security: Blind SSRF on debug.nordvpn.com due to misconfigured sentry instance
Summary: The debug subdomain uses Sentry for application monitoring and error tracking. This software comes with a feature known as source code scraping turned on by default which makes it is possible to make blind get requests from the server on which it is running. Steps To Reproduce: add detai...
EulerOS 2.0 SP2 : bind (EulerOS-SA-2019-2453)
According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called...
Kubernetes: Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io
Good day, I truly hope it treats you great on your side of the screen : I have found that your website http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io is pointed via Name Server records to AWS route 53. These name server records have been deleted, I was able to create a matching zone...
Stripo Inc: subdomain takeover at status0.stripo.email
Hi , The subdomain status0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it. I have parked it with atest account on uptimerobot.com F634639 F634636 thanks Impact Anyone can use this subdomai...
Starbucks: Bulgaria - Subdomain takeover of mail.starbucks.bg
nukedx discovered that the mail.starbucks.bg domain was pointing to a mail service from icn.bg and confirmed that icn.bg did not host this domain. nukedx successfully claimed the subdomain from icn.bg, configured login credentials through the web panel and setup a valid email server. nukedx then...
Mail.ru: [iot-hackathon.geekbrains.ru] Tilda Subdomain Takeover
iot-hackathon.geekbrains.ru subdomain was delegated to tilda.cc service, which is vulnerable to takeover...
Osmedeus v2.1 - Fully Automated Offensive Security Framework For Reconnaissance And Vulnerability Scanning
Osmedeus allows you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target. Installation git clone https://github.com/j3ssie/Osmedeus cd Osmedeus ./install.sh This install only focus on Kali linux, check more install on Usage page How to use ...
Uber: Subdomain takeover on mta1a1.spmail.uber.com
A dangling AWS record on mta1a1.spmail.uber.com allowed a complete DNS zone takeover, giving an adversary access to mta1a1.spmail.uber.com-scoped cookies and CORS, which could facilitate phishing attacks. Thanks again, @0x3c3e! It's so called IP-use-after-free attack. I was able to obtain an IP...