├── index.html ├── .github └── workflows │ └── static.yml └── detect-all-takovers.yaml /index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Subdomain Takeover - Proof of Concept 7 | 32 | 33 | 34 |

35 |

Subdomain Takeover - Proof of Concept

36 |

This subdomain is vulnerable to a subdomain takeover.

37 |

Proof of Control: If you can see this page, the takeover is successful!

38 |

Reported by: EslamMonex

39 |

40 | 41 | 42 | -------------------------------------------------------------------------------- /.github/workflows/static.yml: -------------------------------------------------------------------------------- 1 | # Simple workflow for deploying static content to GitHub Pages 2 | name: Deploy static content to Pages 3 | 4 | on: 5 | # Runs on pushes targeting the default branch 6 | push: 7 | branches: ["main"] 8 | 9 | # Allows you to run this workflow manually from the Actions tab 10 | workflow_dispatch: 11 | 12 | # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages 13 | permissions: 14 | contents: read 15 | pages: write 16 | id-token: write 17 | 18 | # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. 19 | # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. 20 | concurrency: 21 | group: "pages" 22 | cancel-in-progress: false 23 | 24 | jobs: 25 | # Single deploy job since we're just deploying 26 | deploy: 27 | environment: 28 | name: github-pages 29 | url: ${{ steps.deployment.outputs.page_url }} 30 | runs-on: ubuntu-latest 31 | steps: 32 | - name: Checkout 33 | uses: actions/checkout@v3 34 | - name: Setup Pages 35 | uses: actions/configure-pages@v3 36 | - name: Upload artifact 37 | uses: actions/upload-pages-artifact@v2 38 | with: 39 | # Upload entire repository 40 | path: '.' 41 | - name: Deploy to GitHub Pages 42 | id: deployment 43 | uses: actions/deploy-pages@v2 44 | -------------------------------------------------------------------------------- /detect-all-takovers.yaml: -------------------------------------------------------------------------------- 1 | id: detect-all-takeovers 2 | 3 | info: 4 | name: Subdomain Takeover Detection 5 | author: "melbadry9 & pxmme1337" 6 | severity: high 7 | 8 | # Update this list with new takeovers matchers 9 | # Do not delete other template files for takeover 10 | # https://github.com/EdOverflow/can-i-take-over-xyz 11 | # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover. 12 | # Do not report subdomain takeover issues only based on detection. 13 | # Total number of services #71 14 | 15 | requests: 16 | - method: GET 17 | path: 18 | - "{{BaseURL}}/" 19 | matchers-condition: or 20 | 21 | matchers: 22 | - type: word 23 | name: acquia 24 | words: 25 | - If you are an Acquia Cloud customer and expect to see your site at this address 26 | - The site you are looking for could not be found. 27 | 28 | - type: word 29 | name: agilecrm 30 | words: 31 | - Sorry, this page is no longer available. 32 | 33 | - type: word 34 | name: airee 35 | words: 36 | - Ошибка 402. Сервис Айри.рф не оплачен 37 | 38 | - type: word 39 | name: aftership 40 | words: 41 | - Oops.

Oops! We couldn’t find that page.

Error Code: 404

Uh oh. That page doesn’t exist.

180 | 181 | - type: word 182 | name: jazzhr 183 | words: 184 | - This account no longer active 185 | 186 | - type: word 187 | name: jetbrains 188 | words: 189 | - is not a registered InCloud YouTrack. 190 | 191 | - type: word 192 | name: kinsta 193 | words: 194 | - No Site For Domain 195 | 196 | - type: word 197 | name: landingi 198 | words: 199 | - It looks like you're lost 200 | - The page you are looking for is not found 201 | 202 | - type: word 203 | name: launchrock 204 | words: 205 | - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens 206 | to all of us. 207 | 208 | - type: word 209 | name: mashery 210 | words: 211 | - Unrecognized domain 212 | 213 | - type: word 214 | name: ngrok 215 | words: 216 | - ngrok.io not found 217 | - Tunnel *.ngrok.io not found 218 | 219 | - type: word 220 | name: pantheon.io 221 | words: 222 | - "The gods are wise, but do not know of the site which you seek." 223 | 224 | - type: word 225 | name: pingdom 226 | words: 227 | - Public Report Not Activated 228 | - This public report page has not been activated by the user 229 | 230 | - type: word 231 | name: proposify 232 | words: 233 | - If you need immediate assistance, please contact Error 404: Page Not Found" 287 | 288 | - type: word 289 | name: teamwork 290 | words: 291 | - Oops - We didn't find your site. 292 | 293 | - type: word 294 | name: thinkific 295 | words: 296 | - You may have mistyped the address or the page may have moved. 297 | 298 | - type: word 299 | name: tictail 300 | words: 301 | - Building a brand of your own? 302 | - 'to target URL: The page you are looking for doesn't exist or has been 345 | moved.
346 | 347 | - type: word 348 | name: wishpond 349 | words: 350 | - https://www.wishpond.com/404?campaign=true 351 | 352 | - type: word 353 | name: wordpress 354 | words: 355 | - Do you want to register 356 | 357 | - type: regex 358 | name: worksites 359 | regex: 360 | - "(?:Company Not Found|you’re looking for doesn’t exist)" 361 | 362 | - type: word 363 | name: wufoo 364 | words: 365 | - Profile not found 366 | - Hmmm....something is not right. 367 | 368 | - type: word 369 | name: zendesk 370 | words: 371 | - this help center no longer exists 372 | 373 | - type: word 374 | name: readthedocs 375 | words: 376 | - unknown to Read the Docs 377 | 378 | - type: word 379 | name: tilda 380 | words: 381 | - Please renew your subscription 382 | - Please go to the site settings and put the domain name in the Domain tab. 383 | 384 | - type: word 385 | name: smart-jobboard 386 | words: 387 | - This job board website is either expired or its domain name is invalid. 388 | --------------------------------------------------------------------------------