WebSummit: Subdomain take over signup.websummit

Subdomain take over Hi, You have a subdomain aka signup.websummit.net that point to a third party service hosted on Heroku: wsv1.herokuapp.com. The nslookup command shows the DNS configuration. $ nslookup signup.websummit.net 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.853 Non-authoritative answer:...

Finding Hosts Using SSL Certificate Organization And Censys

Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information e.g. bug bounty ToE or IP block. One technique that I use and I am guessing others do ...

Ubiquiti Inc.: Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at sso.ubnt.com via account.ubnt.com. The root cause of this authentication bypass is two-fold: 1. Subdomain ping.ubnt.com was pointing to...

Trello: Subdomain Take over & username enemuration

Bug 1 ====== The ip of domain is not pointing to wpengine.com,Attacker can signup there and takeover subdomain by using this ip check the error message by visiting domain ip it say's that: This domain is successfully pointed at WP Engine, but is not configured for an account on our platform. If y...

Snapchat: Subdomain takeover of blog.snapchat.com

Overview The ANAME for blog.snapchat.com, which redirects to snapchat-blog.com, was pointing to tumblr for Snapchat's blog. This blog had been expired or had removed the CNAME claim. Adding "snapchat-blog.com" to the custom domain setting on tumblr allowed takeover of this subdomain. Repro Steps ...

swarm - A Modular Distributed Penetration Testing Tool

Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function module can be an entirely new...

Boozt Fashion AB: Potential Subdomain Takeover Possible

Issue Description The researcher identified that the affected url points to sendgrid.net, via a DNS CNAME record. As a result of this an attacker could potentially initate a subdomain take over by registering the subdomain sendgrid.boozt.com on sendgrid and consiquently leverage this for further...

Arabseed XCMS 1.0.9 SQL Injection

Exploit Title : Arabseed XCMS V1.0.9 SQL injection Vulnerability Exploit Author : xBADGIRL21 Vendor Homepage : http://arabseed.com/ Tested on: BACKBOX MyBlog : http://xbadgirl21.blogspot.com/ skype:xbadgirl21 Date: 07/09/2016 video Proof : https://youtu.be/ABNSN3XecHw a DESCRIPTION : + Arabseed i...

Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]

After recent finding about one of the Uber’s subdomain takeover was publicly disclosed, I looked into Uber to find similar bugs. One of my colleagues Abhibandu Kafle, pointed out that em.uber.com also had CNAME pointing to SendGrid and could be vulnerable to similar kind of issue. I had limited...

Harvest: Invoices can be added to any retainers - even closs-platform

Summary ------ Hey team, there is an IDOR bug, which allows me to add an invoice to any retainer I wish, even if the retainer belongs to another app/subdomain. Steps to reproduce --------- 1. Make sure you have two apps A and B 2. In A create a retainer, let's say it has id 1234. 3. In B open thi...

Shopify: Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly

Hi, I've found a Shopifu cdn domain here which had an instance of fastly setup but did not remove the dns record when the service was cancelled. a subdomain takeover similar to that of https://hackerone.com/reports/32825 could be possible. Vulnerable URL: http://genghis-cdn.shopify.io Page...

Instacart: [Critical] Subdomain Takeover

Your Subdomains are pointing to unconfigured heroku app. You should immediately remove the DNS-entry. Any One Can Claim That Domain , Please Read The Advisory Below. ::: Nslookup of Subdomains Not Claimed ::::: i 0x00hack3r@pirateking: % nslookup bugs.instacart.com Server: 192.168.1.11 Address:...

Not Your Average Banner Grabber: BannerGrab

Not Your Average Banner Grabber BannerGrab is a PHP-based banner-grabber, which not only helps you find juicy response headers but also, fetches subdomains, and scans the site’s plugins/themes/components if the site is running WordPress/Joomla. To get the subdomains, It uses one of the best...

Bime: Subdomain takeover at ws.bimedb.com due to unclaimed Amazon S3 bucket

The researcher found a subdomain takeover on ws.bimedb.com...

HackerOne: Hacker.One Subdomain Takeover

Hello HackerOne Sec Team, Description : This report is about domain takeover of hacker.one via instapage 0day issue which i just found . Step To Verify : + Visit : https://www.hacker.one + You will see some html updated by me. Impact : + as its one of offical website of hackerone , so attacker ca...

Snapchat: Subdomain takeover on http://fastly.sc-cdn.net/

Hey team, I've found a snapchat cdn domain here which had a test instance of fastly setup but did not remove the dns record when the service was cancelled. This allowed me to create a Fastly instance to take it over. I've confirmed this is a snapchat property via Censys...

Deepmagic Information Gathering Tool: DMitry

Deepmagic Information Gathering Tool DMitry Deepmagic Information Gathering Tool is a UNIX/GNU Linux Command Line program coded purely in C with the ability to gather as much information as possible about a host. DMitry has a base functionality with the ability to add new functions, the basic...

Harvest: Stored XSS on invoice, executing on any subdomain

Summary ----------- There is a stored XSS vulnerability, which can execute on any subdomain as the vulnerability lies in an invoice. You are filtering HTML and js, but you neglect to filter out Flash objects, which can execute javascript. Steps to reproduce ------------- 1. Create an invoice and...

Shopify: https://windsor.shopify.com/ takeover

Hi Shopify, So I was doing some scanning for another client and saw a ton of .shopify.com appear and thought to myself "Huh? I thought shopify.com hosted shops on myshopify.com.. weird, lets check this out". An example is this: http://khanbot.shopify.com/password - as you can see it's a store...

Uber: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com

Limited disclosure at @rojanr's request Subdomains including translate.uber.com, fr.uber.com and de.uber.com were pointing to a CNAME for a site that was not claimed. I was able to claim the site and add any content. For PoC purposes, I showcased my blog on translate.uber.com and de.uber.com...