-
-
Notifications
You must be signed in to change notification settings - Fork 773
Closed
Labels
vulnerableSomeone has provided proof in the issue ticket that one can hijack subdomains on this service.Someone has provided proof in the issue ticket that one can hijack subdomains on this service.
Description
Service name
Readme.io (https://readme.io/)
Proof
The subdomains reside on *.readme.io
. It is a classic virtual hosting scenario like in other similar services.
To verify whether subdomain takeover may be possible, run:
http -b GET http://{DOMAIN NAME} | grep -F -q "Project doesnt exist... yet!" && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible"
(Assuming you have Readme.io account created.)
- Go to dashboard.
- Set Project Name and its subdomain. Subdomain does not need to match the domain you are trying to takeover.
- In left sidebar, go to General Settings -> Custom Domain.
- Set Custom domain to the domain you want to takeover.
- Click Save.
Documentation
Metadata
Metadata
Assignees
Labels
vulnerableSomeone has provided proof in the issue ticket that one can hijack subdomains on this service.Someone has provided proof in the issue ticket that one can hijack subdomains on this service.