HexBrain

Reddit · Report #1591085

Several Subdomains Takeover

N/Astatus
highseverity
2upvotes
8 Jun 2022disclosed

How it was found

there are some subdomains in reddit.com those are vulnerable to takeover subdomain attack. I found these subdomains while I have been testing the subdomains of reddit.com.

Steps To Reproduce:

[add details for how we can reproduce the issue]

  1. create a user account in reddit.com.
  2. there are some subdomain as sample: webcovid19.reddit.com (151.101.13.140) and click on this subdomain.
  3. you will see "Sorry, there aren’t any communities on Reddit with that name" message.
  4. now create an community with the same name "webcovid19".and you will not find any message as above.
  5. well done. now you have the subdomain for your community.

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

1-for details, please find attached screenshots. 2-use this subdomain finder to find subdomains. https://subdomainfinder.c99.nl/

Impact

attacker can use available unclaimed subdomains for malicious intention

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original