Harvest: Stored XSS on invoice, executing on any subdomain

Summary ----------- There is a stored XSS vulnerability, which can execute on any subdomain as the vulnerability lies in an invoice. You are filtering HTML and js, but you neglect to filter out Flash objects, which can execute javascript. Steps to reproduce ------------- 1. Create an invoice and...

Shopify: https://windsor.shopify.com/ takeover

Hi Shopify, So I was doing some scanning for another client and saw a ton of .shopify.com appear and thought to myself "Huh? I thought shopify.com hosted shops on myshopify.com.. weird, lets check this out". An example is this: http://khanbot.shopify.com/password - as you can see it's a store...

Uber: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com

Limited disclosure at @rojanr's request Subdomains including translate.uber.com, fr.uber.com and de.uber.com were pointing to a CNAME for a site that was not claimed. I was able to claim the site and add any content. For PoC purposes, I showcased my blog on translate.uber.com and de.uber.com...

Legal Robot: Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.

Hi, I noticed that the following domain: api.legalrobot.com was returning the following information: NO APPLICATION WAS FOUND FOR api.legalrobot.com F102881 from Modulus.io. The problem with this is that this tends to be pretty bad depending on the service you use. In this case, what I did was to...

Nextcloud: Content Injection in subdomain

Hi there, PoC URL: https://updates.nextcloud.org/.htacess%20Content%20Injection%20test If you need more information, let me know. Thanks!...

Nextcloud: Content injection in subdomain

Hi there, PoC URL: https://download.nextcloud.com/.htacess%20Content%20Injection%20test If you need more information, let me know. Thanks!...

Ubiquiti Inc.: Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry

Hi, So lately I have discovered that CloudFront is not validating which user that connects a CNAME:d domain to a CloudFront Origin. This means that if I could find a domain that is still pointing to CloudFront, without being connected to any Origin as a Custom CNAME, I can actually claim the doma...

Slack: [Screenhero] Subdomain takeover

Hi, I found out some neglected DNS records that can be exploited to takedown the subdomain of Slack's acquisition feedback.screenhero.com The security issue is that you have CNAME record that points feedback.screenhero.com to a screenhero.uservoice.com, but the problem is that the service is...

Deriv.com: CJ vulnerability in subdomain

Ameer Assadi pointed out at one of our subdomain did not have clickjacking protection which had dynamic contents. WriteUp - http://ameeras.me/Binary-Clickjacking-vulnerability/...

Zendesk: [HIGH RISK] CSRF could potentially delete a zendesk subdomain.

The reseracher demonstrated a vulnerabilty that allowed an attacker to delete a Zendesk sponsored and trial instance via CSRF attack on a Zendesk owner...

Uber: Disclosure of ways to the site root

Hello. Go to this address and you see error with addresses https://trip.uber.com/1% Request GET /1% HTTP/1.1 Host: trip.uber.com Connection: keep-alive Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 Windows NT 6.1;...

Snapchat: Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials

Hey team, While doing some recon for Snapchat's domains, I came across a particular domain of interest - sc-corp.net. It seems that this domain hosts a lot of Snapchat's internal tools, web applications and staging environments such as Phabricator and other administration panels. From analyzing S...

Bime: Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io

I noticed BIME is primarily built on Amazon AWS, which spawned my interest. I started looking for DNS entries that were still pointing to S3 buckets that however no longer exist. It appears this was the case for a2.bime.io, which points to an Amazon S3 website bucket in the US East region. Steps ...

Pornhub: Public Facing Barracuda Login

The researcher identified that the mail.pornhub.com subdomain has a public facing web login for Barracuda Spam & Virus Firewall...

KIWI.KI GmbH: Subdomain takeover : URGENT

hi, one of your subdomain is pointing to FRESHDESK but servicce is expire there, so i can claim this http://service.kiwi.ki/ subdomain. Fix: remove dns entry of this subdomain asap Thanks...

Gratipay: limit HTTP methods on other domains

Hi there! I've found out that also one of your subdomains still has HTTP TRACE enabled. This is similar to the issue described in 109054, except that it is for http://inside.gratipay.com. curl -v -X TRACE http://inside.gratipay.com Rebuilt URL to: http://inside.gratipay.com/ Hostname was NOT foun...

New Relic: Potential Subdomain Takeover - http://storefront.newrelic.com/

Hi, The subdomain "storefront.newrelic.com" is currently pointing to Fastly, but is not registered to a service. Depending on whether Fastly permits it, a subdomain takeover similar to that of https://hackerone.com/reports/32825 could be possible. If the subdomain is not needed, it's recommended...

New Relic: SUBDOMAIN TAKEOVER(FIXED)

Hello, I Already Reported This issue Though 180436 Support Ticket , Which is Fixed Now ! Your Subdomain go.newrelic.com is pointing to unbouncepages.com You should immediately remove the DNS-entry for go.newrelic.com is pointing to unbouncepages.com.. Any One Can Claim That Domain , Please Read T...

COMODO Cross Site Scripting

Exploit Title: COMODO Subdomain XSS Vulnerability Google Dork: N/A Date: 2016/2/3 Exploit Author: RootByte Vendor Homepage: http://personalfirewall.comodo.com/ Software Link: N/A Version: N/A Tested on: Windows 10 / FireFox 44.0 CVE : N/A about Wikipedia: COMODO is a privately held group of...

Snapchat: Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition)

harrymg helped us identify an issue in which support.scan.me's CNAME was pointing to scan.zendesk.com. Normally there would be a Zendesk instance there, but in this case, the Zendesk instance was no longer in use. As such, harrymg was able to "claim" scan.zendesk.com from Zendesk. As such, any...