Instapage is still vulnerable in some cases, Edge Case change suggestion

EdOverflow / can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

Creative Commons Attribution 4.0 International

4.83k stars 715 forks source link

Instapage is still vulnerable in some cases, Edge Case change suggestion #349

Open kaiksi-bb opened 1 year ago

kaiksi-bb commented 1 year ago

Hi,

Instapage should be changed to Edge Case IMHO. I believe that as long as the original account that had the domain registered is deleted/suspended it is still possible to takeover.

Service name

Instapage

Proof

poc

dig

404

instapage

CNAME: secure.pageserve.co

Documentation

As explained on the Documentation, as long as the domain does not belong to an existing account the only verification is having the CNAME added:

https://help.instapage.com/hc/en-us/articles/205242898-Adding-and-managing-custom-domains

kaiksi-bb commented 1 year ago

need pay?

No, start free trial 14 days account.

EdOverflow commented 1 year ago

@kaiksi-bb, would you be willing to add this to the discussion over in https://github.com/EdOverflow/can-i-take-over-xyz/issues/73? That helps us keep discussions ongoing.