Automattic: cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com )

Hi, While Looking On The CloudUp Website I found That One of The Subdomain of CloudUp HELP was Hosted on Desk and I think tHe Desk Account of Cloudup was Expired or Canceled by any cause So I have Checked The Site for its CNAME and The CNAME was Resolving to CNAME http://cloudup.desk.com So I Tri...

QIWI: [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSS

Если сделать запрос POST https://pay.qiwi.com/paypage/initial HTTP/1.1 Host: pay.qiwi.com Content-Length: 219 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded...

Acunetix Release Web Site Security Pen Testing Tools Free

HTTP editor, fuzzer and sniffer tools help pen testers identify vulnerabilities London, UK – January 2016 – Hot on the release of Acunetix Version 11, pioneering web application security software Acunetix, now delivering Manual Pen Testing Tools at no cost. Penetration testers can make use of an...

Uber: Subdomain takeover at signup.uber.com

The domain signup.uber.com was pointing to an unclaimed Netlify domain, allowing an attacker to take over the subdomain. We remediated this issue by deleting the CNAME record from our DNS. Thanks, @ak1t4! Another great TKO - thanks UBER!...

Slack: Subdomain takeover on podcasts.slack-core.com

I noticed slack-core.com is used for Slack's call infrastructure. I had never seen that domain before, so I decided to find out what else was running on it. It turned out podcasts.slack-core.com was pointing to a Podcast and RSS hosting service called Feed.Press. However, there was no Feed.Press...

subdomaintakeover.kimtube.nl XSS vulnerability

Vulnerable URL: http://subdomaintakeover.kimtube.nl/s%22%3E%3Cimg%20src=x%20onerror=prompt'OPENBUGBOUNTY'%3E.html Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

WebSummit: Subdomain Takeover at http://gameday.websummit.net

As i said in the title i found a subdomain takeover vulnerability on the url http://gameday.websummit.net The url was trying to find a bucket that didn't exist from a probably forgotten dns entry that was at gameday.websummit.net.s3-website-eu-west-1.amazonaws.com So i created a bucket with the...

Starbucks: http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks.

On Dec 14, 2016, @muhammadkhizerjaved submitted a report to Starbucks via the HackerOne platform. In the report @muhammadkhizerjaved identified that the DNS entry for digital.starbucks.com had a CNAME record that resolved to ghs.google.com. The researcher attempted to takeover the subdomain as pa...

X (Formerly Twitter): GNIP subdomain take over

Hello, Your subdomain at blog.gnipcentral.com is not well configured with allows subdomain take over as @fransoren explained in report 145224 . PoC: Go to http://blog.gnipcentral.com/ , you will be redirected to my domain http://testcloudfrontbug.s3-us-west-2.amazonaws.com/asd/index.html Please f...

Starbucks: Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record

Hi, I discovered that happymondays.starbucks.com DNS CNAME record is pointing to S3 AWS bucket which doesn't exist. Here's the screenshot of vulnerable domain: F138556 As happymondays.starbucks.com was free to register on AWS S3 service and DNS-setup is already correct set-up: F138557 I was able ...

OWOX, Inc.: Subdomain Takeover on OWOX.RU

Subdomain http://www.owox.ru/ was preserved from being taken over by an attacker: https://kiosk.owox.ru/ https://blog.owox.ru/...

OWOX, Inc.: Subdomain Takeover on http://blog.owox.com/

Subdomain Takeover via http://blog.owox.com Subdomain Takeover via http://blog.owox.com...

OWOX, Inc.: Subdomain Takeover on http://kiosk.owox.com/

Subdomain http://kiosk.owox.com/ was preserved from being taken over by an attacker...

PortSwigger Web Security: XSS in IE11 on portswigger.net via Flash

Hello Portswigger Security Team, There is a reflective XSS vulnerability in portswigger.net. The flash file https://portswigger.net/burp/tutorials/video-js/video-js.swf is from an old video.js library version 3.2.0 which is vulnerable to XSS. This XSS will be blocked by CSP instruction object-src...

Ubiquiti Inc.: Subdomain Takeover (moderator.ubnt.com)

Hello Team This report is same as 179110 One of your subdomain http://moderator.ubnt.com is pointing towards 216.58.203.243 moderator.ubnt.com 216.58.203.243 ghs.google.com 216.58.203.243 ghs.l.google.com F134183 And it is unclaimed When I open it it is showing F134184 Impact :- An attacker can...

Paragon Initiative Enterprises: Subdomain Takeover

Hello, Your Subdomain engineering.github.com/paragonie is Pointing to Tumblr.com You should immediately remove the DNS-entry for engineering.zomato.com is Pointing to Tumblr.com.. Any One Can Claim That Domain , Please Read The Advisory Below. Remediation Please make sure you're always going...

RubyGems: Possible Subdomain Takeover at http://production.s3.rubygems.org/ pointing to Fastly

A DNS record was found that was pointing to Fastly, but there was no Fastly service configured for this domain. We removed the record because it was not needed any longer. A subdomain takeover was not possible because although there was no service configured, we do have control of any subdomain o...

Informatica: [parc.informatica.com] Reflected Cross Site Scripting and Open Redirect

Hi ! I just want to report you a vulnerability in your subdomain ,,parc'' Description In this link https://parc.informatica.com/partners/apex/Cloudchat?endpoint= the vulnerable parameter is ,,endpoint''. Once the parameter takes the value of a XSS vector or a website link the code is executed aft...

Brave Software: Subdomain Takeover of Brave.com

Summary: Hey! I want to inform you about sub domain takeover issue i.e. when I did your DNS enumeration i came across :- Ip Address Target Name ---------- ----------- 151.101.9.7 www.brave.com 151.101.9.7 prod.p.ssl.global.fastly.net 151.101.9.7 prod.p.ssl.global.fastlylb.net Except the first...

Uber: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront

Hi, 3 hours ago, rider.uber.com was responding like this: F127137 This happened on both HTTP and HTTPS. Now, as our blog post from last week says: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ This means that there's a high chance this domain does not hav...