HexBrain

WebSummit · Report #193056

Subdomain Takeover at http://gameday.websummit.net

Validstatus
criticalseverity
9upvotes
30 Jan 2017disclosed

How it was found

As i said in the title i found a subdomain takeover vulnerability on the url http://gameday.websummit.net The url was trying to find a bucket that didn't exist from a probably forgotten dns entry that was at gameday.websummit.net.s3-website-eu-west-1.amazonaws.com

So i created a bucket with the specified name and uploaded a poc. POC in the pictures

For more infos please ask...

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original