Shopify · Report #1690951
Subdomain Takeover at course.oberlo.com
Validstatus
14upvotes
1 Dec 2022disclosed
Summary
Subdomain Takeover at oberlo.com via kajabi Services
https://youtu.be/MWKKijndQMY ( Steps Video )
https://pastes.io/ik2rhibj6m ( Writeup in video )
How it was found
Hi,
I was able to takeover your subdomain course.oberlo.com via using kajabi services.
Poc :
visit https://course.oberlo.com/ you will see my poc
https://web.archive.org/web/20220904143512/https://course.oberlo.com/
Suggested Fix :
Clear your subdomain DNS.
Impact
Subdomains Takeovers can be use in many things : Malware Phishing / Spear phishing XSS Authentication bypass Open Redirects True access .. etc
Kind Regards, Mohamed Haron.