Sep 11, 2018

Subdomain Takeover via campaignmonitor

Advertisement







Subdomain Takeover via Campaignmonitor.com
was in Private Program on BugCrowd

what is createsend.com dns ?
its a dns service Belong to campaignmonitor.com
if you create an account on campaignmonitor 
this will give you a subdomain on createsend.com

companies count on Campaign Monitor for email campaigns
So campaignmonitor is only for emails 

*****************************************************************
Steps to subdomain Takeover example 
*****************************************************************
When I go to 
example.site.com 
i found the site like this pic


I notice that subdomain 
example.site.com 
is alias to 
testexample.createsend.com


This mean the domain plan is expired on campaignmonitor
and ready to reactive on another email 

1) So I created an account on campaignmonitor.com
and choose any name
name here i mean an  example.createsend.com

2) After this you need only to add the subdomain of takeover
By going to 
example.createsend.com/account
then 
example.createsend.com/account/customize

Then Just Choose a Custom domain 

example.createsend.com/account/customize/customdomain/manage

3) add your vulnerable subdomain example.site.com
Then Click next 
wait 1 min and the setup will be verified

Congrats 😉
 4) Now when you go to  example.site.com
its will show your example.createsend.com

Takeover Steps is now finished
****************************************************************
Now when anyone go to example.site.com 
it ask him to login to Campaign Monitor
yes as I said at first Campaign Monitor is only to manage emails and Subscribes 

Now if you need to create a small Page Show 
you will only create a Subscribes Page 

Go to this Path

https://example.site.com/templates/create

You can Upload your subscribe page or choose from the templates on the site

example like mine 



***********************************************************************
Reward was 900$
fixed in 10 min from report 
*****************************************************

Share This
Previous Post
Next Post

Security Researcher at Many Websites - Bug Hunter - Civil Engineer Student

0 comments: