HexBrain

X / xAI · Report #119220

Sub-Domain Takeover

Validstatus
4upvotes
18 Mar 2016disclosed

How it was found

Hey !

Your subdomain web.mopub.com is pointing to DYN but you have not claimed it on DYN end.

So what happens here is actually that, since web.mopub.com is pointing to DYN, DYNis actually checking if there's a host with that name. Which in this case was not true. So I was able to claim the domain for my own host, and thus, can place content on this URL.

You should immediately remove the DNS-entry for web.mopub.com pointing to DYN

The issue is bit on same concept of #32825

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original