HexBrain

Stripo Inc · Report #737695

subdomain takeover at status0.stripo.email

Validstatus
mediumseverity
36upvotes
23 Dec 2019disclosed

How it was found

Hi ,

The subdomain status0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it.

I have parked it with atest account on uptimerobot.com

{F634639}

{F634636}

thanks

Impact

Anyone can use this subdomain on uptimerobot.com with a false message.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original