-
## Service name: FeedPress
## Documentation
Based on the information shared in the hackerone report for FeedPress based subdomain, not able to takeover the ownership. The error message on the URL …
-
For some of the mentioned vendors, which I've had experience dealing with, there is no clarification to hackers using this list of where a false positive could occur.
In the instance of Unbounce fo…
-
There seems to be a Host header injection vulnerability in line 26 of `src/password-reset/password-reset.service.ts`
## What is Host Header Injection?
When an application trusts the Host header…
-
Yes, you can perform DNS takeovers of domains pointing to Hurricane Electric's DNS service.
### Service [Hurricane Electric](https://dns.he.net/)
### Status Vulnerable
### Nameserver
>ns5…
-
### Terraform Core Version
1.1.8
### AWS Provider Version
4.49.0
### Affected Resource(s)
The `aws_cognito_risk_configuration` requires a `notify_configuration` block in `account_takeover_risk_co…
-
## Secure email change and multiple identities
### Problem
Allowing just anyone to change your email address without adequate confirmation from both the current email address owner and the new e…
-
## Service name
Microsoft Azure
## Proof
There is no general approach for PoC. Microsoft Azure offers multiple services (CloudApp, Azure Websites, etc.) that use different domain names.
Ge…
-
## Service name
Landingi
## Proof
Landingi is Vulnerable to Subdomain Takeover
If you get an Error Similar to this one
![Fingerprint](https://user-images.githubusercontent.com/17003859/6533…
-
Great presentation at MSSN CTRL! This is my first attempt at running DIANA, so something might be misconfigured or I might be holding it wrong..
When trying to scrap any URL, I get an error that ju…
-
The ARF 2.1 states that it provides "high-security authentication" -- but there are no details on what that is, or how it is accomplished. Account protection is hard. Large providers today (Amazon, Ap…