Subdomain takeover vulnerabilities occur when a subdomain (subdomain.example.com) is pointing to a service (e.g. GitHub pages, Heroku, etc.) that has been removed or deleted.
This allows an attacker to set up a page on the service that was being used and point their page to that subdomain.
For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com.
Safely Demonstrating A Subdomain Takeover
Based on personal experience, claiming the subdomain discreetly and serving a harmless file on a hidden page is usually enough to demonstrate the security vulnerability. Do not serve content on the index page. A good proof of concept could consist of an HTML comment served via a random path:
$ cat aelfjj1or81uegj9ea8z31zro.html
<!– PoC by username –>
Please be advised that this depends on what bug bounty program you are targeting. When in doubt, please refer to the bug bounty program’s security policy and/or request clarifications from the team behind the program.
You can submit new services here: https://github.com/EdOverflow/can-i-take-over-xyz/issues/new?template=new-entry.md.
A list of services that can be checked (although check for duplicates against this list first) can be found here: https://github.com/EdOverflow/can-i-take-over-xyz/issues/26.
The specified bucket does not exist
Repository not found
|‘Trying to access your account?’
404 Not Found
|Cargo Support Page
|Domain Security on Amazon CloudFront
Please try again or try Desk.com free for 14 days.
Fastly error: unknown domain:
The feed has not been found.
404 Not Found
|Freshdesk Support Page
The thing you were looking for is no longer here, or never was
There isn't a Github Pages site here.
|Issue #37Issue #68
|Google Cloud Storage
404 Blog is not found
We could not find what you're looking for.
|Help Juice Support Page
No settings were found for this company:
No such app
Uh oh. That page doesn't exist.
is not a registered InCloud YouTrack
|YouTrack InCloud Help Page
No Site For Domain
It looks like you may have taken a wrong turn somewhere. Don't worry...it happens to all of us.
|HackerOne #275714, Issue #14
404 error unknown site!
Project doesnt exist... yet!
Sorry, this shop is currently unavailable.
|Issue #32, Issue #46
|Visiting the subdomain will redirect users to https://www.statuspage.io.
page not found
project not found
Whatever you were looking for doesn't currently exist at this address
Please renew your subscription
The requested URL was not found on this server.
page not found
This UserVoice subdomain is currently available!
Do you want to register *.wordpress.com?
Help Center Closed
The authors of this document take no responsibility for correctness. This project is merely here to help guide security researchers towards determining whether something is vulnerable or not, but does not guarantee accuracy. This project heavily relies on contributions from the public; therefore, proving that something is vulnerable is the security researcher and bug bounty program’s sole discretion. On top of that, it is worth noting that some bug bounty programs may accept dangling DNS record reports without requiring proof of compromise.