RBKmoney · Report #363778
SUBDOMAIN TAKEOVER [http://dev.rbk.money/]
Validstatus
mediumseverity
11upvotes
2 Jul 2018disclosed
Summary
The DNS record of dev.rbk.money pointed to the Github, but the domain was not used in any Github account. So it was possible to bind it to any repository.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.