DNS Reconnaissance: AQUATONE

DNS Reconnaissance AQUATONE is a set of tools for performing reconnaissance on domain names. It can discover subdomains on a given domain by using open sources as well as the more common subdomain dictionary brute force approach. After subdomain discovery, AQUATONE can then scan the hosts for...

Belati - The Traditional Swiss Army Knife for OSINT

Belati is tool for Collecting Public Data & Public Document from Website and other service for OSINT purpose. This tools is inspired by Foca and Datasploit for OSINT. What Belati can do? WhoisIndonesian TLD Support Banner Grabbing Subdomain Enumeration Service Scanning for all Subdomain Machine W...

Mixmax: Subdomain takeover (sales.mixmax.com)

Unused DNS record was reported, we promptly removed...

Mixmax: Possible Subdomain Takeover

None of the weakness categories really fit this so I apologize for that. The subdomain sales.mixmax.com points to 151.101.16.229, a webflow.io proxy server. Because it 404s, this leads me to believe that a subdomain takeover is possible through the webflow service as whatever this is pointing to ...

Cuvva: Subdomain take over oh-no.cuvva.co and ohno.cuvva.co

Cuvva has an old EV certificate which lists a very large number of subject alternative names SANs, as listed below. These were included because we anticipated potentially wanting to use these hostnames in the future and it was free to add them. Very few of the hostnames actually exist, and those...

Cuvva: Clickjacking vulnerability in support-dashboard.corp.cuvva.co

Hi i found a clickjacking vulnerability in the subdomain of cuvva.com i.e, support-dashboard.corp.cuvva.co Impact: The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard PoC: 1. ...

Udemy: Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.com

Hello @Udemy! Summary ===== I previously reported a cross-site scripting vulnerability 222337 at coding-exercises.udemy.com. I recently discovered that GitBook-hosted sites are also vulnerable to subdomain takeovers due to a trailing dot vulnerability in the GitBook "Custom Domain" feature seen...

Shopify: [ux.shopify.com] Subdomain takeover

The subdomain ux.shopify.com points to domains.tumblr.com, but this subdomain is not used by anyone on Tumblr. Any user can register his blog for this subdomain. ux.shopify.com. 3600 IN CNAME domains.tumblr.com. F176574 As an PoC, I registered a blog for this subdomain. It is available only with...

HackerOne: Subdomain takeover #4 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/217358 i've been able to bypass it and takeover the subdomain info.hacker.one with a new vulnerable ENDPOINT + PARAM COMBINATION at UnbouncePages App Actual Dns Entry: F174718 Reproduction Steps fo...

Uber: Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at auth.uber.com via saostatic.uber.com. The root cause of this authentication bypass is two-fold: 1. Subdomain saostatic.uber.com was...

X (Formerly Twitter): [██████████.gnip.com] .htpasswd disclosure

Greetings, There is a .htpasswd disclosure on your subdomain : - Go to : http://█████████.gnip.com/.htpasswd - previewgnip:██████ F173925 Fix : Protect the htpasswd file...

Nextcloud: Directory Listing In Subdomain Of nextcloud.com

Hi Sir/Madam , I found a directory listing bug in one of your subdomain - https://apps.nextcloud.com Here is the location of directory listing https://apps.nextcloud.com/static/ here is the access to some of your files By, Baskaran XyberWolf...

Starbucks: [connect.teavana.com] Open Redirect and abuse of connect.teavana.com

This report highlights an open redirect and abuse on a subdomain of teavana.com. The attacker could create an account with a third party company and use that to create a fake campaign. The attacker could then promote the link using a subdomain of teavana.com/ and send the subdomain of teavana.com...

HackerOne: Subdomain takeover #3 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/209004 i've been able again to bypass it again and takeover the subdomain info.hacker.one with a new vulnerable PARAM at UnbouncePages App Actual Dns Entry: F172446 Steps To Reproduce & New PoC for...

Ubiquiti Inc.: Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry

So lately I have discovered that CloudFront is not validating which user that connects a CNAME:d domain to a CloudFront Origin. This means that if I could find a domain that is still pointing to CloudFront, without being connected to any Origin as a Custom CNAME, I can actually claim the domain...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

Udemy: Subdomain Takeover at Landing.udemy.com

Target: Landing.udemy.com Details: The target subdomain points to unbounce.com service, via a DNS CNAME record. As a result of this, an attacker could potentially initiate a subdomain takeover by registering the subdomain on unbounce.com. Additionally, Unbounce is a custom 404-page hosting servic...

Lyst: Site configured improperly at subdomain of lyst.co.uk

Steps to reproduce the issue: Go to : "https://w.lyst.co.uk/" It will give you message The owner of w.lyst.co.uk has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. Image: F163225 A attacker will send this link to user...

Shopify: Subdomain takeover on s3.shopify.com

Preword I know that this is not explicitly in scope, but I still felt it was serious enough to justify a report and let you decide the potential impact. Description The subdomain s3.shopify.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This meant that anyo...

New Relic: [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpoint

Hi, While conducting New Relic web property reconnaissance, I came across the unused docs-ra.newrelic.com endpoint. This endpoint allowed an unauthenticated user to progress through the Drupal installation process and activate the site with their own configuration – it appears that valid MySQL...