Cuvva: Clickjacking vulnerability in support-dashboard.corp.cuvva.co

Hi i found a clickjacking vulnerability in the subdomain of cuvva.com i.e, support-dashboard.corp.cuvva.co Impact: The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard PoC: 1. ...

Udemy: Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.com

Hello @Udemy! Summary ===== I previously reported a cross-site scripting vulnerability 222337 at coding-exercises.udemy.com. I recently discovered that GitBook-hosted sites are also vulnerable to subdomain takeovers due to a trailing dot vulnerability in the GitBook "Custom Domain" feature seen...

Shopify: [ux.shopify.com] Subdomain takeover

The subdomain ux.shopify.com points to domains.tumblr.com, but this subdomain is not used by anyone on Tumblr. Any user can register his blog for this subdomain. ux.shopify.com. 3600 IN CNAME domains.tumblr.com. F176574 As an PoC, I registered a blog for this subdomain. It is available only with...

HackerOne: Subdomain takeover #4 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/217358 i've been able to bypass it and takeover the subdomain info.hacker.one with a new vulnerable ENDPOINT + PARAM COMBINATION at UnbouncePages App Actual Dns Entry: F174718 Reproduction Steps fo...

Uber: Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at auth.uber.com via saostatic.uber.com. The root cause of this authentication bypass is two-fold: 1. Subdomain saostatic.uber.com was...

X (Formerly Twitter): [██████████.gnip.com] .htpasswd disclosure

Greetings, There is a .htpasswd disclosure on your subdomain : - Go to : http://█████████.gnip.com/.htpasswd - previewgnip:██████ F173925 Fix : Protect the htpasswd file...

Nextcloud: Directory Listing In Subdomain Of nextcloud.com

Hi Sir/Madam , I found a directory listing bug in one of your subdomain - https://apps.nextcloud.com Here is the location of directory listing https://apps.nextcloud.com/static/ here is the access to some of your files By, Baskaran XyberWolf...

Starbucks: [connect.teavana.com] Open Redirect and abuse of connect.teavana.com

This report highlights an open redirect and abuse on a subdomain of teavana.com. The attacker could create an account with a third party company and use that to create a fake campaign. The attacker could then promote the link using a subdomain of teavana.com/ and send the subdomain of teavana.com...

HackerOne: Subdomain takeover #3 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/209004 i've been able again to bypass it again and takeover the subdomain info.hacker.one with a new vulnerable PARAM at UnbouncePages App Actual Dns Entry: F172446 Steps To Reproduce & New PoC for...

Ubiquiti Inc.: Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry

So lately I have discovered that CloudFront is not validating which user that connects a CNAME:d domain to a CloudFront Origin. This means that if I could find a domain that is still pointing to CloudFront, without being connected to any Origin as a Custom CNAME, I can actually claim the domain...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

Udemy: Subdomain Takeover at Landing.udemy.com

Target: Landing.udemy.com Details: The target subdomain points to unbounce.com service, via a DNS CNAME record. As a result of this, an attacker could potentially initiate a subdomain takeover by registering the subdomain on unbounce.com. Additionally, Unbounce is a custom 404-page hosting servic...

Lyst: Site configured improperly at subdomain of lyst.co.uk

Steps to reproduce the issue: Go to : "https://w.lyst.co.uk/" It will give you message The owner of w.lyst.co.uk has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. Image: F163225 A attacker will send this link to user...

Shopify: Subdomain takeover on s3.shopify.com

Preword I know that this is not explicitly in scope, but I still felt it was serious enough to justify a report and let you decide the potential impact. Description The subdomain s3.shopify.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This meant that anyo...

New Relic: [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpoint

Hi, While conducting New Relic web property reconnaissance, I came across the unused docs-ra.newrelic.com endpoint. This endpoint allowed an unauthenticated user to progress through the Drupal installation process and activate the site with their own configuration – it appears that valid MySQL...

OLX: Subdomain Takeover (http://docs.olx.ph/ , http://calendar.olx.ph/, http://sites.olx.ph/)

Hello There, I found Sub-Domain Takeover in olx.ph , Kindly take a look sir. These subdomains http://docs.olx.ph/ , http://calendar.olx.ph/, http://sites.olx.ph/ is pointing towards docs.olx.ph is an alias for ghs.googlehosted.com. ghs.googlehosted.com has address 216.58.201.179...

OWOX, Inc.: Subdomain takeover in many subdomains

Subdomain takeover was possible in some of the subdomains. Though you cant claim it and host your page but it compromises them of using certain google services like GMAIL,Calendar,G-Drive,etc on those susbdomains. Subdomain takeover was possible in some of the subdomains. Though you cant claim it...

Informatica: [wave.informatica.com]- Subdomain missconfiguration

One of your subdomain https://wave.informatica.com has a CNAME record that resolved to ghs.google.com and shows 404 error when navigating to subdomain. You should remove CNAME entry for that subdomain pointing towards ghs.google.com. Although I couldnt verify the domain ownership process to fully...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

Automattic: cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com )

Hi, While Looking On The CloudUp Website I found That One of The Subdomain of CloudUp HELP was Hosted on Desk and I think tHe Desk Account of Cloudup was Expired or Canceled by any cause So I have Checked The Site for its CNAME and The CNAME was Resolving to CNAME http://cloudup.desk.com So I Tri...