Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Subdomain takeover using https://tilda.cc/ #155

Open
m0ns7er opened this issue Jul 7, 2020 · 2 comments
Open

Subdomain takeover using https://tilda.cc/ #155

m0ns7er opened this issue Jul 7, 2020 · 2 comments
Labels
vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service.

Comments

@m0ns7er
Copy link

m0ns7er commented Jul 7, 2020

Service name

https://tilda.cc/

Proof

https://hackerone.com/reports/894657

Documentation

Subdomains which are pointing to tilda.cc,and has a unclaimed DNS record are vulnerable for subdomain-takeover.

Reference

https://help.tilda.ws/customdomain#:~:text=Navigate%20to%20the%20Site%20Settings,in%20the%20right%20upper%20corner.
@EdOverflow EdOverflow added the vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service. label Feb 3, 2021
@pdelteil
Copy link
Contributor

pdelteil commented Apr 4, 2021

I just took over one Tilda domain.

This is the error message

Screenshot from 2021-04-03 23-12-39

@pdelteil
Copy link
Contributor

pdelteil commented May 7, 2021

I found one with another error message

"Please renew your subscription". In this case is not possible to take over the subdomain.

Screenshot from 2021-05-06 23-26-58

pdelteil added a commit to pdelteil/nuclei-templates that referenced this issue May 7, 2021
@pdelteil
Update tilda-takeover.yaml
c0db77d 
This update is based on this issue EdOverflow/can-i-take-over-xyz#155
@pdelteil pdelteil mentioned this issue May 7, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@m0ns7er @EdOverflow @pdelteil