Unbounce is not vulnerable for subdomain takeover.

Question

Unbounce is not vulnerable for subdomain takeover.

smiegles opened this issue 6 years ago · 83 comments

smiegles commented 6 years ago

The attacker here used an un-ethical way to exploit Unbounce which is resolved now as far as I believe.

https://github.com/EdOverflow/can-i-take-over-xyz#unbounce

ak1t4 commented 6 years ago

;)

Abhaysoft-inc commented 2 years ago

no bro

Answer 1 · 2018-03-28T13:40:47.000Z

Going through the hackerone report it seems that this instance of subdomain takeover was indeed an exploitation of a vulnerability on the Unbounce services. In the same report, both parties (researcher and Unbounce security team) confirm that the Unbounce vulnerability has been fixed.
Unless there is another instance of subdomain takeover for Unbounce I'll agree with @smiegles that Unbounce's entry is a false-positive.

Answer 2 · 2018-03-29T17:22:41.000Z

@edeirme , subdomain takeover with Unbounce is still possible. I confirmed this right now by creating a domain and then setting its CNAME to unbouncepages.com. This is what Unbounce asks its user to do. If you have a domain that is pointed to unbouncepages.com but does not look claimed, you can create a user account, add a PayPal or Credit Card and then add a custom domain. Once the custom domain is added and you publish a page, it should display the content in that domain.

Answer 3 · 2018-03-29T21:21:11.000Z

@rojan-rijal ur totally right .. last night i reported a subdomain takover and it was using unbounce. The sec team triaged it asap ..!
😅

Answer 4 · 2018-04-04T16:27:20.000Z

I think the main issue is the fact that we reference https://hackerone.com/reports/202767 in the Unbounce section which, as @smiegles pointed out, is not accurate and can no longer be exploited. We should remove that reference. Thank you for raising an issue, @smiegles.

Answer 5 · 2018-04-12T07:51:24.000Z

Are you sure the takeover is still possible?
I am getting this error message when I try to "Add a New Custom Domain":

Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.

Answer 6 · 2018-04-15T14:45:26.000Z

Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com

Any idea how we can now

Answer 7 · 2018-04-16T19:02:34.000Z

I don't think we can if someone has an unbounce account I can give you a link to test

Answer 8 · 2018-04-17T16:11:13.000Z

@rosonsec @d55pak, Last I checked it was still possible. There might be some edge cases though for example, when I tested, I simply pointed my domain to Unbounces CNAME and see if it was vulnerable. In your case it seems like the domain was being used activity before and then removed from Unbounce. Unbounce might be blocking takeover on those types of domains but I am not sure yet. I will look into this further and update the ticket.
Cheers!

Answer 9 · 2018-04-17T16:12:41.000Z

@rojan-rijal if you DM me on Twitter I can give you a previously used domain that is still pointing to a unbounce CNAME

Answer 10 · 2018-04-28T09:56:38.000Z

I have tried to takeover 10 subdomains which has following Fingerprint
The requested URL was not found on this server.

Results of 10 subdomains are either:

Domain is already in use.
( or )
Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.

Looks like unbounce preventing us from takeovers which they have used their service previously.

👍

Answer 11 · 2018-04-28T10:04:27.000Z

Sorry, I have been extremely busy lately and have not had a chance to update the project. We determined that there is only one rare case where one can hijack a subdomain pointing to Unbounce and that is if the team never had a project in the first place. The likelihood of this being the case is so minute that I personally do not think we should claim that it is possible to hijack subdomains pointing towards Unbounce. Thank you to everyone who participated in this discussions here; it is an absolute pleasure seeing everyone working together like this. :)

Answer 12 · 2018-04-28T17:27:17.000Z

Hey there, I was reading this thread and seems pretty interesting. Which is a subdomain takeover?

A subdomain takeover is posible when the attacker can claim an unclaimed domain name through an alias or canonical name (cname) pointing to unbouncepages.com.
Some 3rd party services put filters to avoid this, like adding a random TXT record or hash or others methods to force and secure the DNS entries as unique per customer, which is NOT the case of unbouncepages.
An attacker can claim a domain not claimed over unbouncepages.com. So, We have 3 scenarios when we want takeover a subdomain over unbounce:

'Domain is already in use' (which means that the domain is claimed)
'Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.' (Which means that the domain is NOT actually claimed or used but unbounce detect that the domain was used in the pass) [they put this filter as intent to avoid takeovers.]
Claim the domain (no errors: the domain is added to domains section correctly)

*The 3rd options is still available and works: so YES, unbouncepages is Vulnerable to Subdomain Takeover.

regards,
@ak1t4

Answer 13 · 2018-11-13T10:12:32.000Z

@EdOverflow @codingo Takeover via Unbounce is still Vulnerable as @ak1t4 said there is 3 cases .. I do a takeover last week and my friend do 1 takeover from unbounce less than month ago

Answer 14 · 2018-11-13T20:23:26.000Z

@ak1t4 They mentioned here this is Edge Case and in the main status Not vulnerable ..
This Poc belong to the duplicate report which got duplicate after traiged and fixed :-(

Answer 15 · 2018-11-15T12:07:48.000Z

That awkward moment when you realise that you have left the target's hostname in the tab bar. :P

Answer 16 · 2018-11-15T12:17:15.000Z

@EdOverflow By mistake :-D

but its fixed now and didn't Pay.

Answer 17 · 2018-11-15T17:05:49.000Z

hahahaahah!!!

Answer 18 · 2019-04-11T09:47:03.000Z

Hi,
where I can find vulnerable domain sites because I tried for many one but not get it to perform subdomain takeover. Even search in google dork.

Answer 19 · 2019-05-08T12:25:29.000Z

No bro there is an old Subdomains connected to Unbounce Services so Unbounce takeover is still exist.

Answer 20 · 2019-05-19T11:50:46.000Z

Hi @Vishnugadupudi as @ak1t4 said :

We have 3 scenarios when we want takeover a subdomain over unbounce:

'Domain is already in use' (which means that the domain is claimed)

'Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.' (Which means that the domain is NOT actually claimed or used but unbounce detect that the domain was used in the pass) [they put this filter as intent to avoid takeovers.]

Claim the domain (no errors: the domain is added to domains section correctly)

info.hacker.one is already in use and already has pages example :
https://info.hacker.one/the-data-protection-officer/
https://info.hacker.one/2018-hacker-report/

This mean case (1)
Domain is already in use' (which means that the domain is claimed)

So not possible to takeover it .

Kind Regards,
Mohamed Haron.

Answer 21 · 2019-05-21T08:57:42.000Z

@m7mdharoun :)

Answer 22 · 2019-09-04T16:33:55.000Z

hello.guys.
takeover is still possible???

Answer 23 · 2019-09-27T17:17:51.000Z

hello.guys.
takeover is still possible???

I just tried today and it fails ....

Answer 24 · 2019-09-28T14:20:28.000Z

yup.me too.seems it needs a bit of luck.

Answer 25 · 2019-12-11T21:37:35.000Z

You can found Steps here and This is still vulnerable

https://www.youtube.com/watch?v=-znOxODC2QM

Answer 26 · 2019-12-21T13:39:11.000Z

I have tried to takeover 10 subdomains which has following Fingerprint
The requested URL was not found on this server.

Results of 10 subdomains are either:

Domain is already in use.
( or )
Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.

Looks like unbounce preventing us from takeovers which they have used their service previously.

👍

exactly same errors

Answer 27 · 2019-12-21T20:21:21.000Z

I have tried to takeover 10 subdomains which has following Fingerprint
The requested URL was not found on this server.

Results of 10 subdomains are either:

Domain is already in use.
( or )
Looks like this domain has been deleted, to be able to use it again we need to verify its ownership for security purposes. Please contact our team at support@unbounce.com.

Looks like unbounce preventing us from takeovers which they have used their service previously.

👍

exactly same errors

You Just need Good Luck to find it but it still work ;)

Answer 28 · 2019-12-27T05:13:20.000Z

thanks for the confirmation

Answer 29 · 2020-01-17T16:23:07.000Z

I just test it 3 minutes ago, it will need a little bit of social engineering to verify the deleted subdomain.

chat help:

verify the ownership by adding a txt record.

Answer 30 · 2020-01-22T09:37:20.000Z

@X-shadowt
how to do verification for deleted subdomain?

Answer 31 · 2020-01-24T22:07:14.000Z

Can you please confirm which Unbounce account this domain is going to be added to? Thanks so much!

Here's how to add the record:

Login to your Domain provider's system and navigate to the DNS setup.
Create a new DNS record.
The record type will be TXT.
The host name can be left blank.
The text (or content, or value) should be "unbounce=357292‍ "
Save the changes.

Send me a reply once that's been done, I'll confirm everything, and we'll get finished up with verifying your domain!```

this is how you can do it

Answer 32 · 2020-02-07T06:52:28.000Z

@X-shadowt how you added dns record :P

Answer 33 · 2020-05-12T16:51:46.000Z

I noticed that social engineering was mentioned here. Social engineering is not acceptable when participating in bug bounty programs (unless stated), nor is it acceptable in any case. I'd suggest NOT social engineering the friendly team at Unbounce to bypass their verification steps. You may end up in legal trouble and for what? A bounty? Not worth it. If you feel that unbounces methods for proving you own a domain are not adequate and you can 'bypass' them, i'd send them a message to politely let them know. Work with them, not against them :)

Stay safe everyone. <3

Answer 34 · 2020-05-12T23:45:58.000Z

Thank you very much @zseano for pointing this out for the community!

At Unbounce safekeeping our customers and their information within our ecosystem is of utmost importance.
We believe in the mantra that no environment is 100% secure, and that upholding information security is an iterative effort and a process of continuous improvement.
Aside from our own internal resources we also partner with third party security researchers and firms to perform approved and prescheduled external vulnerability scans and penetration tests against our environment.

We would like to stress that our Acceptable Use Policy (which is part of our Terms of Service), as well as those of our infrastructure hosting provider's, prohibit users, customers, and third parties from performing unapproved vulnerability tests/scans against our platform.

Currently, we do not have a formal bug bounty program in the traditional sense with monetary rewards; but it is something we are considering as we appreciate the work of security researchers like yourself.
As such, and in the absence of a bug bounty program, we deem all unapproved tests/scans as unauthorized activities.

With that said, we completely support, and see the value in, sharing findings/PoCs online to educate others. However, in the event that you had unknowingly performed a test/scan against our platform, we ask that you remain committed to an ethical methodology in your approach.
To this end, we ask that you report your findings to security@unbounce.com first, and that you kindly refrain from sharing your results externally until our engineers have had the time to assess what you have reported.

Thank you all very much.
Please stay healthy and safe!

Answer 35 · 2020-05-20T18:39:54.000Z

Thank you for addressing this, @zseano & @UBAMas. I will add a note about this in the README for future contributors. 👍

Answer 36 · 2020-06-28T17:20:15.000Z

Hello
I found subdomain which is saying - The requested URL was not found on this server.
I check the cname for that subdomain, but i didn't found any cname .
Than i try to add this subdomain on unbounce . Its takes all the thing but when processing its still on configuration saying "Hang in there—we’re processing your domain!"
what should i do now

Answer 37 · 2020-07-01T16:48:33.000Z

@foysal1197 I got the same response - The requested URL was not found on this server.

May I report it?

Answer 38 · 2020-07-01T16:56:39.000Z

@foysal1197 I got the same response - The requested URL was not found on this server.

May I report it?

Sure No don't report until , you must be sure that you takeover this subdomain.

let's Take a small example :

Hackerone has subdomain called info.hacker.one This subdomain show you error The requested URL was not found on this server.

visit https://info.hacker.one/

But it works well in paths example :

visit https://info.hacker.one/2018-hacker-report/

Kind Regrads,
Mohamed Haron.

Answer 39 · 2020-07-01T17:07:24.000Z

I searched the whole internet with dork and every tool but there is sub file like test.domain.com/test.php . It only have single domain that is test.domain.com which is showing error that requested url not found on this server. What should I do? @m7mdharoun

…

On Wed, 1 Jul 2020, 10:26 pm m7mdharoun, ***@***.***> wrote: @foysal1197 <https://github.com/foysal1197> I got the same response - The requested URL was not found on this server. May I report it? Sure No don't report until , you must be sure that you takeover this subdomain. let's Take a small example : Hackerone has subdomain called info.hacker.one This subdomain show you error The requested URL was not found on this server. visit https://info.hacker.one/ But it works well in paths example : visit https://info.hacker.one/2018-hacker-report/ Kind Regrads, Mohamed Haron. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#11 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQDTYIBYO4EYOARIK466KS3RZNTFNANCNFSM4EX2LSXA> .

Answer 40 · 2020-07-23T01:02:45.000Z

@Bplotka @foysal1197 Did you ever manage to perform subdomain takeover for Unbounce? I don't think it will be possible now until you interact with the unbounce team, as per the link here: https://documentation.unbounce.com/hc/en-us/articles/360000851786

Answer 41 · 2020-07-28T14:24:15.000Z

@UBAMas explained that you shouldn't be trying this. Closing the issue.

Answer 42 · 2020-08-26T21:12:07.000Z

Hi @m7mdharoun I still have the same error The requested URL was not found on this server.

how can i exploit it?

Answer 43 · 2020-11-18T17:22:52.000Z

not vulnerable

Answer 44 · 2020-11-28T15:26:40.000Z

Is it still possible in 2020 to takeover subdomain in unbounce.com with this "The requested URL was not found on this server." error?
Anyone ??

Answer 45 · 2020-11-29T01:29:07.000Z

@AyushMayank no it's not bro

Answer 46 · 2020-11-29T06:55:50.000Z

@X-shadowt yah I was thinking that too... thanks

Answer 47 · 2021-05-03T02:23:30.000Z

Hello ,
I just test 3 subdomains with 404 Error Via Unbounce .
i noticed that the Subdomain With CName Record Like this

Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65

Is 100% Not Vulnerable And You Can't Claim it .

But if the Cname Record Was Like this :

Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.

it is 100% Vulnerable For Takeover And Congrats about the bounty 💯

Answer 48 · 2021-05-07T04:33:10.000Z

Hello ,
I just test 3 subdomains with 404 Error Via Unbounce .
i noticed that the Subdomain With CName Record Like this
Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65
Is 100% Not Vulnerable And You Can't Claim it .

But if the Cname Record Was Like this :
Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.
it is 100% Vulnerable For Takeover And Congrats about the bounty 100

Are you sure ?

Found a case just like you said and this is what I got

Answer 49 · 2021-05-10T14:26:43.000Z

Hello ,
I just test 3 subdomains with 404 Error Via Unbounce .
i noticed that the Subdomain With CName Record Like this
Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65
Is 100% Not Vulnerable And You Can't Claim it .
But if the Cname Record Was Like this :
Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.
it is 100% Vulnerable For Takeover And Congrats about the bounty 100
Are you sure ?

Found a case just like you said and this is what I got

@pdelteil ur perfectly right, while i was testing for takeovers i encountered the same issue

if the subdomain is pointed this way then its 100% not a subdomain takeover

and i tried to claim it:) this was the result!

Answer 50 · 2021-05-10T14:28:32.000Z

all the best

Answer 51 · 2021-05-14T07:52:49.000Z

by any chance it is possible to take over this subdomain .. i dont want to register my credit card to create an account and try

Answer 52 · 2021-05-14T10:01:21.000Z

No i think it 's not possible to claim it .

Answer 53 · 2021-05-14T19:30:54.000Z

Everytime you find an long string identifier, chances you can take the domain are very low.

…

On Fri, 14 May 2021, 06:01 0xElmalky, ***@***.***> wrote: No i think it 's not possible to claim it . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE2OS75WBWO3XAHHWDAIEI3TNTYIJANCNFSM4EX2LSXA> .

Answer 54 · 2021-05-17T16:00:58.000Z

is takeover possible here

Answer 55 · 2021-06-29T16:18:07.000Z

can you bypass Unbounce's control by doing an NSLOOKUP and using the alias associated with the domain that Unbounce has blocked?

Answer 56 · 2022-01-13T11:37:02.000Z

so Unbounce not a vuln ?

Answer 57 · 2022-01-20T03:05:10.000Z

It's vulnerable?

Answer 58 · 2022-09-02T13:50:12.000Z

is it still working ?

Answer 59 · 2022-09-13T21:18:31.000Z

Does this still work, anyone ?

Answer 60 · 2022-10-08T19:06:25.000Z

Does this still work, anyone ?

no

Answer 61 · 2023-01-18T10:42:10.000Z

@rojan-rijal ur totally right .. last night i reported a subdomain takover and it was using unbounce. The sec team triaged it asap ..! 😅
how you exploited i mean how takeover

Answer 62 · 2023-01-19T23:45:03.000Z

I confirm that Unbounce is still vulnerable to subdomain takeovers since I successfully took over a subdomain 17 days ago (23 December 2022).

Answer 63 · 2023-01-20T06:14:30.000Z

Hello , I just test 3 subdomains with 404 Error Via Unbounce . i noticed that the Subdomain With CName Record Like this
Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65
Is 100% Not Vulnerable And You Can't Claim it .

But if the Cname Record Was Like this :
Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.
it is 100% Vulnerable For Takeover And Congrats about the bounty 100

Hello, can you tell me the tool name I also have the same problem with this .Please

Answer 64 · 2023-01-20T07:09:43.000Z

Thank you Sent from Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Sayan Chakraborty ***@***.***> Sent: Friday, January 20, 2023 9:14:44 AM To: EdOverflow/can-i-take-over-xyz ***@***.***> Cc: fsocietyxzy ***@***.***>; Comment ***@***.***> Subject: Re: [EdOverflow/can-i-take-over-xyz] Unbounce is not vulnerable for subdomain takeover. (#11) Hello , I just test 3 subdomains with 404 Error Via Unbounce . i noticed that the Subdomain With CName Record Like this Non-authoritative answer: Sub.Domain.com canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com. 1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com canonical name = unbouncepages.com. Name: unbouncepages.com Address: 18.196.95.178 Name: unbouncepages.com Address: 54.93.101.65 Is 100% Not Vulnerable And You Can't Claim it . But if the Cname Record Was Like this : Non-authoritative answer: Sub.Domain.com canonical name = unbouncepages.com. Name: unbouncepages.com Address: 18.195.98.178 Name: unbouncepages.com Address: 54.93.101. it is 100% Vulnerable For Takeover And Congrats about the bounty 100 Hello, can you tell me the tool name I also have the same problem with this .Please — Reply to this email directly, view it on GitHub<#11 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A47PWBTRDZNJYB5GMI7JGCLWTIUNJANCNFSM4EX2LSXA>. You are receiving this because you commented.Message ID: ***@***.***>

Answer 65 · 2023-03-14T20:07:41.000Z

it is 100% Vulnerable For Takeover And Congrats about the bounty 100

which command i can use to check this ?

Answer 66 · 2023-05-01T16:46:36.000Z

dig subdomain.domain.com

Answer 67 · 2023-05-11T19:06:41.000Z

I confirm that Unbounce is still vulnerable to subdomain takeovers since I successfully took over a subdomain 17 days ago (23 December 2022).

how you bypass the domain error?

Answer 68 · 2023-05-11T19:11:45.000Z

Hello ,
I just test 3 subdomains with 404 Error Via Unbounce .
i noticed that the Subdomain With CName Record Like this
Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65
Is 100% Not Vulnerable And You Can't Claim it .
But if the Cname Record Was Like this :
Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.
it is 100% Vulnerable For Takeover And Congrats about the bounty 100
Are you sure ?

Found a case just like you said and this is what I got

this is the same error I am facing, anybody knows if it is still possible to bypass it and take over?

Answer 69 · 2023-05-11T19:13:26.000Z

I confirm that Unbounce is still vulnerable to subdomain takeovers since I successfully took over a subdomain 17 days ago (23 December 2022).

how you bypass the domain error?

There was no error, for me at least. I guess it was pure luck, I guess?

Answer 70 · 2023-05-11T20:37:43.000Z

I confirm that Unbounce is still vulnerable to subdomain takeovers since I successfully took over a subdomain 17 days ago (23 December 2022).

how you bypass the domain error?

There was no error, for me at least. I guess it was pure luck, I guess?

maybe, good for you.
What about the txt record entry thing mentioned above, aren't we need to have access to the target's root domain for this?
btw I just contacted the support team and they also provide me with an entry to add as Txt record, can I add this in any domain I owned?

Answer 71 · 2023-08-24T02:44:45.000Z

Hello , I just test 3 subdomains with 404 Error Via Unbounce . i noticed that the Subdomain With CName Record Like this
Non-authoritative answer:
Sub.Domain.com	canonical name = 1b450602efa347e0ac14sadwa8be95d.unbouncepages.com.
1b450602efa347e0ac14c4fb0a8be95d.unbouncepages.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.196.95.178
Name:	unbouncepages.com
Address: 54.93.101.65
Is 100% Not Vulnerable And You Can't Claim it .
But if the Cname Record Was Like this :
Non-authoritative answer:
Sub.Domain.com	canonical name = unbouncepages.com.
Name:	unbouncepages.com
Address: 18.195.98.178
Name:	unbouncepages.com
Address: 54.93.101.
it is 100% Vulnerable For Takeover And Congrats about the bounty 100
Hello, can you tell me the tool name I also have the same problem with this .Please
Yes you are right

Hi, is there any special indication other than cname, for example from the protocol whether SSL is available, error or not?

Answer 72 · 2023-09-13T11:13:28.000Z

still vulnerable ?

Answer 73 · 2023-12-15T18:04:37.000Z

still vulnerable ?

Unfortunately not possible.

Answer 74 · 2023-12-23T00:45:38.000Z

It's still vulnerable but only as a rare edge case, I exploited a valid one a few days ago - see Stratus-Security/Subdominator#1 (comment)

Answer 75 · 2024-01-06T20:48:03.000Z

Hello @coj337 I recently saw on Unbounce account giving an 404 Status code. Could you please help me confirm if its vulnerable for subdomain takeover with your account? I don't have funds to purchase one. Thank you very much sir.

Answer 76 · 2024-01-06T20:49:16.000Z

If it is, then well share the outcome.
Am a bug bounty hunter by the way :)

Answer 77 · 2024-05-10T11:21:09.000Z

I was able to add a domain but it says "Error Finding CNAME" How can i resolve this anyone?

Answer 78 · 2024-05-16T20:43:53.000Z

Hello, even after when you add your domain, It is not vulnerable.
Just shift your attention to something else.

Answer 79 · 2024-05-16T20:45:12.000Z

Not true.

If you manage to add a custom domain then there's a complete subdomain take over.

Answer 80 · 2024-05-17T11:00:43.000Z

Not true.

If you manage to add a custom domain then there's a complete subdomain take over.

Yeah i think so, it's possible, The domain was pointing at a random ip address while using dig command and when i can subzy it was vulnerable to unbounce subdomain takeover and also when i claimed the subdomain it got claimed but after that it was asking for a cname to go live i guess. So, if anyone knows how to do that please help

Answer 81 · 2024-05-21T13:14:35.000Z

Ok. No challenge.
I'll be glad to learn how you will do that.
Thanks and regards