HackerOne · Report #159156
Hacker.One Subdomain Takeover
Validstatus
lowseverity
154upvotes
20 Sept 2016disclosed
Summary
Hey all :) here is the blog for the same : http://www.geekboy.ninja/blog/hijacking-tons-of-instapage-expired-users-domains-subdomains/ :)
How it was found
Hello HackerOne Sec Team,
Description :
This report is about domain takeover of hacker.one via instapage 0day issue which i just found .
Step To Verify :
- Visit : https://www.hacker.one
- You will see some html updated by me.
Impact :
- as its one of offical website of hackerone , so attacker can serve anything like login page or etc as he have complete access to main domain !
Possible Fix :
- For now just remove the cname of instapage , till i try to contact them and get complete fix .
Please let me know if any more info needed !
Regards Geekboy !