HexBrain

Urban Dictionary · Report #103432

URGENT - Subdomain Takeover in support.urbandictionary.com pointing to Zendesk

Validstatus
1upvotes
4 Jan 2016disclosed

How it was found

Hi. I found out that one of your subdomain which is http://support.urbandictionary.com/ can be taken over or is vulnerable to subdomain takeover. If youre gonna visit the site... you will see saying:

No help desk at support.urbandictionary.com

There is no help desk configured at this address. This means that the address is available and that you can claim it at http://www.zendesk.com/signup/

Which means that the subdomain can be claimed by anyone. Just easy, register and then set it up. Claimed. If claimed, hackers can do something bad about it especially to urbandictionary users.. Please fix Asap.. Thanks

For more info please read this: http://labs.detectify.com/post/109964122636/hostile-subdomain-takeover-using

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original