Reddit · Report #1591085
Several Subdomains Takeover
N/Astatus
highseverity
2upvotes
8 Jun 2022disclosed
How it was found
there are some subdomains in reddit.com those are vulnerable to takeover subdomain attack. I found these subdomains while I have been testing the subdomains of reddit.com.
Steps To Reproduce:
[add details for how we can reproduce the issue]
- create a user account in reddit.com.
- there are some subdomain as sample: webcovid19.reddit.com (151.101.13.140) and click on this subdomain.
- you will see "Sorry, there aren’t any communities on Reddit with that name" message.
- now create an community with the same name "webcovid19".and you will not find any message as above.
- well done. now you have the subdomain for your community.
Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
1-for details, please find attached screenshots. 2-use this subdomain finder to find subdomains. https://subdomainfinder.c99.nl/
Impact
attacker can use available unclaimed subdomains for malicious intention