Authorization Bypass

bind is vulnerable to authorization bypass. The vulnerability exists through an Incorrect documentation of krb5-subdomain and ms-subdomain update policies...

bind: Incorrect documentation of krb5-subdomain and ms-subdomain update policies

To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...

Starbucks: Subdomain takeover of datacafe-cert.starbucks.com

Summary: The subdomain datacafe-cert.starbucks.com had an CNAME record pointing to an unclaimed Azure webservice. This is a high severity security issue because an attacker can register the subdomain on Azure and therefore can own the subdomain datacafe-cert.starbucks.com. Description: The dangli...

Starbucks: Subdomain takeover of d02-1-ag.productioncontroller.starbucks.com

Summary: I was able to claim the subdomain: d02-1-ag.productioncontroller.starbucks.com using Azure Cloud Service Platforms Affected: Subdomain Azure Cloud Service Steps To Reproduce: 1. Using dig, I was able to determine that the subdomain 'd02-1-ag.productioncontroller.starbucks.com' was...

Cloudcheck - Checks Using A Test String If A Cloudflare DNS Bypass Is Possible Using CloudFail

Cloudcheck is made to be used in the same folder as CloudFail. Make sure all files in this repo are in the same folder before using. Also create a empty text file called none.txt in the data folder, that way it doesn't do a subdomain brute when testing. Cloudcheck will automatically change your...

WordPress Plugin OneSignal Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports the hosting of personal blog sites on servers with PHP and MySQL.OneSignal is an application push notification service. A cross-site scripting vulnerability exists in the WordPre...

WordPress OneSignal 1.17.5 Plugin (subdomain) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin OneSignal 1.17.5 - Persistent Cross-Site Scripting Date: 2019-07-18 Vendor Homepage: https://www.onesignal.com Software Link: https://wordpress.org/plugins/onesignal-free-web-push-notifications/ Affected version...

Radancy: Developper's websites are easily accessibles leading to massive information disclosure

Domain and URL: .devmaximum.com ███████████.acc.devmaximum.com Hello, I've found a couple hundred of devmaximum websites with personal datas. I know this subdomains are out of scope, i've discovered them with devmaximum.maximum.nl's SSL certificate. But in less than 30 minutes of testing i've...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

Can lead to millions of player accounts to be hijacked: EA Games account hijacking vulnerability analysis-vulnerability warning-the black bar safety net

One, overview In the past few weeks, Check Point Research and CyberInt common to confirm a series of vulnerabilities, and these vulnerabilities once an attacker might cause the world's second-largest game company EA Games to millions of players accounts being taken over. At the same time, these...

Account Takeover Vulnerability Found in Popular EA Games Origin Platform

A popular gaming platform used by hundreds of millions of people worldwide has been found vulnerable to multiple security flaws that could have allowed remote hackers to takeover players' accounts and steal sensitive data. The vulnerabilities in question reside in the "Origin" digital distributio...

Mail.ru: xss

Reflected XSS via GET parameters in terrhq.ru subdomain...

RecScanSec - Reconnaisance Scanner Security

RecScanSec made for reconnaisance Scanner and information gathering with an emphasis on simplicity. It will do everything from. Features Information Security Headers WAF Analyzer Information Disclosure Banner Grabbing Url Crawl HTML Form Detector Port Scanner Get SSL Information Subdomain...

Recsech - Tool For Doing Footprinting And Reconnaissance On The Target Web

Recsech is a tool for doing Footprinting and Reconnaissance on the target web. Recsech collects information such as DNS Information, Sub Domains, HoneySpot Detected, Subdomain takeovers, Reconnaissance On Github and much more you can see in Features in tools . Features in tools Name | Release |...

Findomain - A Cross-Platform Tool That Use Certificate Transparency Logs To Find Subdomains

A cross-platform tool that use Certificates Transparency logs to find subdomains. We currently support Linux, Windows and MacOS. How it works? It tool doesn't use the common methods for subdomains discover, the tool uses Certificate Transparency logs to find subdomains and it method make it tool...

Shipt: Multiple Subdomain Takeovers: fly.staging.shipt.com, fly.us-west-2.staging.shipt.com, fly.us-east-1.staging.shipt.com

A researcher identified 3 different abandoned subdomain CNAME records that pointed to a 3rd party service fly.io that Shipt had recently stopped using. Upon receiving the report, the Shipt information security team responded quickly and resolved the issue by removing the stale DNS records...

ReconT - Reconnaisance / Footprinting / Information Disclosure

Recon-Tool made for reconnaissance and information gathering with an emphasis on simplicity. It will do everything from. Features Information Security Headers WAF Detector Banner Grabbing Phone Number Credit Card Number Email US Social Security Number Url Crawl Dom Paramter Url Internal Dynamic...

Starbucks: Subdomain takeover of mydailydev.starbucks.com

A subdomain of starbucks.com had a CNAME record pointing to an Azure Traffic Manager profile that @0xpatrik was able to claim...

Vanilla: Spoofing the redirect process using RTLO

Hi team, Description: I was testing this subdomain rinkerboats.vanillacommunities.com and after some search, I found this path url https://rinkerboats.vanillacommunities.com/home/leaving?Target=https://google.com/ which used to redirect the users to external websites now this is good because you...