KIWI.KI GmbH · Report #118514

Subdomain takeover : URGENT

Informativestatus

3upvotes

25 Feb 2016disclosed

Summary

KIWI had been trialing the use of FreshDesk internally, and had left a DNS entry pointed to their services which subsequently was out of control of KIWI. This could have been used to confuse or trick KIWI customers.

How it was found

hi,

one of your subdomain is pointing to FRESHDESK but servicce is expire there, so i can claim this http://service.kiwi.ki/ subdomain.

Fix: remove dns entry of this subdomain asap

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original