Shopify: Subdomain takeover on s3.shopify.com

Preword I know that this is not explicitly in scope, but I still felt it was serious enough to justify a report and let you decide the potential impact. Description The subdomain s3.shopify.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This meant that anyo...

New Relic: [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpoint

Hi, While conducting New Relic web property reconnaissance, I came across the unused docs-ra.newrelic.com endpoint. This endpoint allowed an unauthenticated user to progress through the Drupal installation process and activate the site with their own configuration – it appears that valid MySQL...

OLX: Subdomain Takeover (http://docs.olx.ph/ , http://calendar.olx.ph/, http://sites.olx.ph/)

Hello There, I found Sub-Domain Takeover in olx.ph , Kindly take a look sir. These subdomains http://docs.olx.ph/ , http://calendar.olx.ph/, http://sites.olx.ph/ is pointing towards docs.olx.ph is an alias for ghs.googlehosted.com. ghs.googlehosted.com has address 216.58.201.179...

OWOX, Inc.: Subdomain takeover in many subdomains

Subdomain takeover was possible in some of the subdomains. Though you cant claim it and host your page but it compromises them of using certain google services like GMAIL,Calendar,G-Drive,etc on those susbdomains. Subdomain takeover was possible in some of the subdomains. Though you cant claim it...

Informatica: [wave.informatica.com]- Subdomain missconfiguration

One of your subdomain https://wave.informatica.com has a CNAME record that resolved to ghs.google.com and shows 404 error when navigating to subdomain. You should remove CNAME entry for that subdomain pointing towards ghs.google.com. Although I couldnt verify the domain ownership process to fully...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

Automattic: cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com )

Hi, While Looking On The CloudUp Website I found That One of The Subdomain of CloudUp HELP was Hosted on Desk and I think tHe Desk Account of Cloudup was Expired or Canceled by any cause So I have Checked The Site for its CNAME and The CNAME was Resolving to CNAME http://cloudup.desk.com So I Tri...

QIWI: [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSS

Если сделать запрос POST https://pay.qiwi.com/paypage/initial HTTP/1.1 Host: pay.qiwi.com Content-Length: 219 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded...

Acunetix Release Web Site Security Pen Testing Tools Free

HTTP editor, fuzzer and sniffer tools help pen testers identify vulnerabilities London, UK – January 2016 – Hot on the release of Acunetix Version 11, pioneering web application security software Acunetix, now delivering Manual Pen Testing Tools at no cost. Penetration testers can make use of an...

Uber: Subdomain takeover at signup.uber.com

The domain signup.uber.com was pointing to an unclaimed Netlify domain, allowing an attacker to take over the subdomain. We remediated this issue by deleting the CNAME record from our DNS. Thanks, @ak1t4! Another great TKO - thanks UBER!...

Slack: Subdomain takeover on podcasts.slack-core.com

I noticed slack-core.com is used for Slack's call infrastructure. I had never seen that domain before, so I decided to find out what else was running on it. It turned out podcasts.slack-core.com was pointing to a Podcast and RSS hosting service called Feed.Press. However, there was no Feed.Press...

subdomaintakeover.kimtube.nl XSS vulnerability

Vulnerable URL: http://subdomaintakeover.kimtube.nl/s%22%3E%3Cimg%20src=x%20onerror=prompt'OPENBUGBOUNTY'%3E.html Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

WebSummit: Subdomain Takeover at http://gameday.websummit.net

As i said in the title i found a subdomain takeover vulnerability on the url http://gameday.websummit.net The url was trying to find a bucket that didn't exist from a probably forgotten dns entry that was at gameday.websummit.net.s3-website-eu-west-1.amazonaws.com So i created a bucket with the...

Starbucks: http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks.

On Dec 14, 2016, @muhammadkhizerjaved submitted a report to Starbucks via the HackerOne platform. In the report @muhammadkhizerjaved identified that the DNS entry for digital.starbucks.com had a CNAME record that resolved to ghs.google.com. The researcher attempted to takeover the subdomain as pa...

X (Formerly Twitter): GNIP subdomain take over

Hello, Your subdomain at blog.gnipcentral.com is not well configured with allows subdomain take over as @fransoren explained in report 145224 . PoC: Go to http://blog.gnipcentral.com/ , you will be redirected to my domain http://testcloudfrontbug.s3-us-west-2.amazonaws.com/asd/index.html Please f...

Starbucks: Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record

Hi, I discovered that happymondays.starbucks.com DNS CNAME record is pointing to S3 AWS bucket which doesn't exist. Here's the screenshot of vulnerable domain: F138556 As happymondays.starbucks.com was free to register on AWS S3 service and DNS-setup is already correct set-up: F138557 I was able ...

OWOX, Inc.: Subdomain Takeover on OWOX.RU

Subdomain http://www.owox.ru/ was preserved from being taken over by an attacker: https://kiosk.owox.ru/ https://blog.owox.ru/...

OWOX, Inc.: Subdomain Takeover on http://blog.owox.com/

Subdomain Takeover via http://blog.owox.com Subdomain Takeover via http://blog.owox.com...

OWOX, Inc.: Subdomain Takeover on http://kiosk.owox.com/

Subdomain http://kiosk.owox.com/ was preserved from being taken over by an attacker...

PortSwigger Web Security: XSS in IE11 on portswigger.net via Flash

Hello Portswigger Security Team, There is a reflective XSS vulnerability in portswigger.net. The flash file https://portswigger.net/burp/tutorials/video-js/video-js.swf is from an old video.js library version 3.2.0 which is vulnerable to XSS. This XSS will be blocked by CSP instruction object-src...