Fastly Restrictions

Question

Fastly Restrictions

riramar opened this issue 6 years ago · 70 comments

Fastly will work only in some specific situations. In some cases they validate the customer domain before assign the fastly.net subdomain.

https://docs.fastly.com/guides/securing-communications/managing-domains-on-tls-certificates#verifying-domain-ownership

Verifying domain ownership
Any time you request addition of a domain to a certificate, you must verify you own the domain. This helps us ensure no one else is using your domain without your permission.

Answer 1 · 2018-07-12T17:07:27.000Z

That certainly merits further investigation!

@EdOverflow I'm unable to look at this for a week, what's your capacity like? Happy for you to tag me on this if you're snowed under also.

Related to the work on #20 I think this should be done in a test cases and then added to the main readme.

Answer 2 · 2018-07-16T14:27:43.000Z

Here is the verification screen and types.
DNS, Email, or text file file upload.

Answer 3 · 2018-10-29T07:39:40.000Z

Hi @EdOverflow ,

I've been confirmed on my last report that this is not a valid vulnerability. This is the default Fastly error message if you are visiting the sub-domain directly which is not the intended use case, since it is part of a redirect by the CDN.

Regards,
tolo7010

Answer 4 · 2019-04-20T20:34:29.000Z

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

Answer 5 · 2019-04-29T01:49:26.000Z

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

Answer 6 · 2019-04-29T03:12:24.000Z

Hi bro. Is it possible to have the required steps? Le lun. 29 avr. 2019 à 2:49 AM, m7mdharoun <notifications@github.com> a écrit :

…

Hi @EdOverflow <https://github.com/EdOverflow>, Is it still possible to claim subdomain on Fastly? Regards, Yes Bro I do a Takeover last 2 days for a 4 domains. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#22 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AI2PH4Y5F7AVHC7CULVE4N3PSZH2VANCNFSM4FJQJFVQ> .

Answer 7 · 2019-05-13T14:18:39.000Z

Can someone post step by step subdomain takeover on fastly?

Answer 8 · 2019-05-13T17:05:41.000Z

@n1ghtfox its simple and easy ..

create a new service ( ex: version 1) .
add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps.
then in the Origin Host add Your VPS ip without ssl if not include port 80.
Active your service ( version 1 )

if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this
http://domain.com.global.prod.fastly.net and it will show your vps page.
Sure you can wait 10 min to avoid doing this step :)

Kind Regards,
Mohamed Haron.

Answer 9 · 2019-05-13T18:38:44.000Z

Thanks, i could never register domain, so i thought there was other way around.

…

On Mon, May 13, 2019 at 9:05 PM m7mdharoun ***@***.***> wrote: @n1ghtfox <https://github.com/n1ghtfox> its simple and easy .. 1. create a new service ( ex: version 1) . 2. add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps. 3. then in the Origin Host add Your VPS ip without ssl if not include port 80. 4. Active your service ( version 1 ) if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this http://domain.com.global.prod.fastly.net and it will show your vps page. Sure you can wait 10 min to avoid doing this step :) Kind Regards, Mohamed Haron. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMUD6WAC4QRATAQTTSLPVGNWVA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVI6KHI#issuecomment-491906333>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMVDGB6D7ZHJE7L2VPDPVGNWVANCNFSM4FJQJFVQ> .

Answer 10 · 2019-05-22T14:21:51.000Z

@m7mdharoun,

In 2nd point, you have mentioned add subdomain. This is victim subdomain right?
And what if it get rejected. Is there a way to control traffic like redirection?

Answer 11 · 2019-06-09T13:01:59.000Z

i think i'm up to something can u help me out on fastly?

…

On Wed, May 22, 2019 at 6:21 PM venkatst ***@***.***> wrote: @m7mdharoun <https://github.com/m7mdharoun>, In 2nd point, you have mentioned add subdomain. This is victim subdomain right? And what if it get rejected. Is there a way to control traffic like redirection? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMXHHVPRPIXEXY25HU3PWVJIJA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODV7GX7Q#issuecomment-494824446>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMQCS6SPRG7UBKEEMS3PWVJIJANCNFSM4FJQJFVQ> .

Answer 12 · 2019-06-24T10:20:50.000Z

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:

sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx

I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

Answer 13 · 2019-06-24T10:25:57.000Z

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

Answer 14 · 2019-07-09T18:42:20.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

Answer 15 · 2019-07-11T01:35:22.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

Yes I also got the same error

Answer 16 · 2019-08-04T00:38:56.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Answer 17 · 2019-08-04T04:20:08.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

Answer 18 · 2019-08-06T13:36:25.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

The same error, Any updates!?

Answer 19 · 2019-08-07T01:07:51.000Z

Just for confirmation of how Fastly is still possible to takeover, check out www.litium.de. This shall confirm the edge scenario.

Answer 20 · 2019-10-14T13:17:29.000Z

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

Any Updates got the same error!

Answer 21 · 2019-10-16T18:48:21.000Z

is it possible that we can take over any vulnerable subdomain using fastly services or not or we use the different services which that domain use?

Answer 22 · 2019-10-22T22:55:11.000Z

Hey, just used this method to takeover a subdomain and it worked. But still it's an edge case. In this one, the error was :
"Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala"

Answer 23 · 2019-12-05T07:43:33.000Z

i am getting the same error as above described by mefkan. "Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala". but still unable to add domain to fastly

I am getting error - domain "abc" is already taken by another customer. Am i doing something wrong here?

Answer 24 · 2019-12-08T09:17:41.000Z

Any Updates got the same error! I am getting error - domain "abc" is already taken by another customer

Answer 25 · 2019-12-08T12:26:37.000Z

This is still an edge case. Got 2 takeovers during this week for the same program, so it’s still vulnerable but not every time.

On Sun, 8 Dec 2019 at 2:47 PM, bbbb ***@***.***> wrote: Any Updates got the same error! I am getting error - domain "abc" is already taken by another customer — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=ACW5BD6L4YPPQPCPGDOWRITQXS3TNA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGGZLCI#issuecomment-562926985>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACW5BD2BCE5KTUTOWNWDLF3QXS3TNANCNFSM4FJQJFVQ> .

-- Best, Sumit Grover

Answer 26 · 2019-12-08T12:30:48.000Z

@sumgr0 For the same program? They were using two different domains in scope rigth?
At this time fastly is checking the domain(example.com) given, if it is taken once you can't register any of the subdomains (ignorebyfastly.example.com)
So a company is vulnerable only if they stop completly from using fastly for a whole domain.

Answer 27 · 2019-12-08T12:32:24.000Z

That’s right 2 different subdomains on the same program were covered by the scope.

…

On 08-Dec-2019, at 6:00 PM, MelarDev ***@***.***> wrote: @sumgr0 <https://github.com/sumgr0> For the same program? They were using two different domains in scope rigth? At this time fastly is checking the domain(example.com) given if it is taken once you can't register any of the subdomains (ignorebyfastly.example.com) So a company is vulnerable only if they stop completly from using fastly for a whole domain. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=ACW5BD2WLAGSWGXZT5ZDMRLQXTSHTA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGG5JJI#issuecomment-562943141>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACW5BDZWKLCV5IOI3MGSXDTQXTSHTANCNFSM4FJQJFVQ>.

Answer 28 · 2019-12-08T12:39:41.000Z

@sumgr0 so you took over subdomain1.example.com and subdomain2.example.com ? Fastly UI says the opposite than you do, if you try to take subdomain1.example.com Fastly is only checking if example.com is taken, if it is you can't not register subdomain1.example.com nor subdomain2.example.com nor any other subdomain for that example.com, even if one of them is showing the fingerprint error message.

Answer 29 · 2019-12-08T12:45:43.000Z

I understand, and confirm it worked for this time and allowed. Also the reason, as mentioned by the program, they were in the process of decommissioning the Fastly service, while I took over the subdomains. I've had mostly the experience of it not working, but once or twice it worked. Maybe due to the way the account is configured by the programs (they may or may not be using wildcards).

Hence, it seems if the setup contains the wildcard entries, it does not allow to takeover any subdomain belonging to the program and gives out the error: domain "abc" is already taken by another customer. And works when they setup individual subdomains on the service.

Hopefully this helps.

Answer 30 · 2019-12-08T13:14:40.000Z

@sumgr0 Yes, it helps, thanks =)

Answer 31 · 2019-12-09T15:10:42.000Z

another corner case is :-
arjuns-MacBook-Air:domaintakeover arjunsharma$ dig elle.tw

; <<>> DiG 9.10.6 <<>> elle.tw
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42494
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;elle.tw. IN A

;; ANSWER SECTION:
elle.tw. 86400 IN A 151.101.128.200
elle.tw. 86400 IN A 151.101.192.200
elle.tw. 86400 IN A 151.101.0.200
elle.tw. 86400 IN A 151.101.64.200

arjuns-MacBook-Air:domaintakeover arjunsharma$ dig www.elle.tw

; <<>> DiG 9.10.6 <<>> www.elle.tw
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19199
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.elle.tw. IN A

;; ANSWER SECTION:
www.elle.tw. 80835 IN CNAME www.elle.com.tw.
www.elle.com.tw. 60 IN CNAME nonssl.global.fastly.net.
nonssl.global.fastly.net. 30 IN A 151.101.128.204
nonssl.global.fastly.net. 30 IN A 151.101.0.204
nonssl.global.fastly.net. 30 IN A 151.101.64.204
nonssl.global.fastly.net. 30 IN A 151.101.192.204

this kind of misconfigurations is also making services vulnerable

Answer 32 · 2020-04-11T15:55:50.000Z

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?
Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

can you guide us how you did it

Answer 33 · 2020-04-11T15:56:08.000Z

can you guide us how you did it

Answer 34 · 2020-04-11T15:57:37.000Z

here bro https://www.youtube.com/watch?v=9DYEg_j-_hw

Answer 35 · 2020-04-11T15:57:59.000Z

thanks very much

Answer 36 · 2020-04-11T16:05:56.000Z

Great PoC thanks for that I also follow you blog learned subdomain takeover through you blogs

here bro https://www.youtube.com/watch?v=9DYEg_j-_hw

Great PoC thanks for that I also follow you blog learned subdomain takeover through you blogs and I guess the subdomain i was trying to takeover is not vulnerable becoz it says " domain is already took by another customer"

Answer 37 · 2020-04-13T17:25:20.000Z

I'm facing now with this shit Domain 'blahblah.com' is already taken by another customer
Can someone explain me how to fix this shit.

Answer 38 · 2020-04-13T17:59:27.000Z

The 'blahblah.com' is secured and not possible to take over

Answer 39 · 2020-07-04T12:44:25.000Z

Is it still possible to claim subdomain on Fastly?

Answer 40 · 2020-07-11T20:55:11.000Z

I successfully claimed a domain
But the link it is generating is
Domain.com.fastly.net
It should show only domain.com
Or domain.com.fastly.net is also correct?

Answer 41 · 2020-07-23T04:08:33.000Z

@sumgr0 so you took over subdomain1.example.com and subdomain2.example.com ? Fastly UI says the opposite than you do, if you try to take subdomain1.example.com Fastly is only checking if example.com is taken, if it is you can't not register subdomain1.example.com nor subdomain2.example.com nor any other subdomain for that example.com, even if one of them is showing the fingerprint error message.

Is there any way to bypass this?

Answer 42 · 2020-07-23T04:13:32.000Z

Only if the parent domain is not registered with wildcard entry. I've not seen anymore cases with fastly service takeover.

Answer 43 · 2020-10-09T04:11:11.000Z

It seems that it is not vulnearble because when we try takeover sub_1.test.com , it says that test.com is already registered.

Answer 44 · 2021-01-22T05:59:46.000Z

vikrams-MacBook-Air:domaintakeover arjunsharma$ dig https://critik.in/best-lip-balms-in-india/

; <<>> DiG 9.10.6 <<>> https://critik.in/best-lip-balms-in-india/
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19199
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;

https://critik.in/best-lip-balms-in-india/ IN A

;; ANSWER SECTION:

https://critik.in/best-lip-balms-in-india/ 80835 IN CNAME https://critik.in/best-lip-balms-in-india/
https://critik.in/best-lip-balms-in-india/ 60 IN CNAME nonssl.global.fastly.net.
nonssl.global.fastly.net. 30 IN A 151.101.128.204
nonssl.global.fastly.net. 30 IN A 151.101.0.204
nonssl.global.fastly.net. 30 IN A 151.101.64.204
nonssl.global.fastly.net. 30 IN A 151.101.192.204

this kind of misconfigurations is also making services vulnerable

Answer 45 · 2021-03-02T02:22:03.000Z

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:
sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx
I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

hi @vaadataa how can i register map.fastly.net domain?
Thank~

Answer 46 · 2021-03-03T00:22:37.000Z

can yu tell me how because this is not workin for me

Answer 47 · 2021-03-21T10:29:45.000Z

@vaadataa how can i register map.fastly.net domain? Now i only get a *.global.prod.fastly.net domain

Answer 48 · 2021-06-03T03:31:09.000Z

After testing many domains with the error page. I haven't found a way to take over the subdomains.

I think this has been fixed and not properly reported here.

Answer 49 · 2021-07-14T06:51:45.000Z

who knows why i can't takeover this subdomain , is very sad~

Answer 50 · 2021-12-15T08:52:24.000Z

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says
Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

Create new delivery service
Name test-example.s3.amazonaws.com
Host is my VPS

Worked

Answer 51 · 2021-12-15T08:52:43.000Z

<p title=” </noscript> <style onload= alert(document.domain)//"> *{/*all*/color/*all*/:/*all*/#f78fb3/*all*/;} </style> .qmbox .qmbox .qmbox *{color:#f78fb3;}

Answer 52 · 2021-12-26T13:51:40.000Z

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message:
Domain 'blahblah.com' is already taken by another customer

Answer 53 · 2021-12-26T22:27:24.000Z

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message: Domain 'blahblah.com' is already taken by another customer

This mean blahblah.com Not Vulnerable to takeover.

Answer 54 · 2022-03-07T23:23:08.000Z

Is there no way to bypass these errors..?

Domain 'socialcodia.facebook.com' is already taken by another customer.

Answer 55 · 2022-03-08T04:03:25.000Z

this domain seems has register buy others ------------------ 原始邮件 ------------------ 发件人: "EdOverflow/can-i-take-over-xyz" ***@***.***>; 发送时间: 2022年3月8日(星期二) 上午7:23 ***@***.***>; ***@***.******@***.***>; 主题: Re: [EdOverflow/can-i-take-over-xyz] Fastly Restrictions (#22) Is there no way to bypass these errors..? Domain 'socialcodia.facebook.com' is already taken by another customer. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you commented.Message ID: ***@***.***>

Answer 56 · 2022-03-28T13:41:34.000Z

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

Create new delivery service

Name test-example.s3.amazonaws.com

Host is my VPS

Worked

I got the same page in www-TARGET-com.TARGET.com

BUT I didn't understand your tips and I don't know where (Create new delivery service) and the other tips
can you please explain it more deeper
my Twitter:_2os5

Answer 57 · 2022-03-28T13:41:55.000Z

<p title=” </noscript> <style onload= alert(document.domain)//"> *{/*all*/color/*all*/:/*all*/#f78fb3/*all*/;} </style> .qmbox .qmbox .qmbox *{color:#f78fb3;}

Answer 58 · 2022-06-18T12:33:50.000Z

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net
Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

Answer 59 · 2022-06-18T19:12:16.000Z

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

No you can only add domain and Fastly choose the name for your domain.

Even you able to takeover target.com.map.fastly.net Services won't Run until you add Domain

Answer 60 · 2022-08-19T20:27:46.000Z

I think Fastly is no more vulnerable for subdomain takeover .

Answer 61 · 2022-09-05T10:42:21.000Z

@sawravchy I think this is still an edge case - as described by @mohamed-faris , his example still works:

Answer 62 · 2022-09-05T13:13:01.000Z

Ok got it. Thanks for clarifying this.

Answer 63 · 2022-10-07T08:42:36.000Z

fastly error for somthing.target.com is not vulnerable
But somthing.target.in was is vulnerable. can i report

Answer 64 · 2022-10-31T09:27:20.000Z

hi @m7mdharoun , i used subjack tool and find 5 domain which are showing FASTLY . can vulnerable

Answer 65 · 2022-11-24T05:18:48.000Z

Hii @m7mdharoun my custom domain is saved but i get this " Domain does not resolve to the GitHub Pages server" pls help me

Answer 66 · 2023-11-15T12:22:49.000Z

Just made a takeover. Thank you mate @mohamed-faris

Answer 67 · 2024-01-18T04:51:12.000Z

I just tried with 600 domains giving the fingerprint, none of them resulted in a takeover.

Answer 68 · 2024-06-02T11:09:24.000Z

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

the link is not working!!

Answer 69 · 2024-06-14T15:38:47.000Z

fastly is an edge case its still vuln when none claimed domain tested on a live target
http://live.pandora.com

Answer 70 · 2024-09-22T17:19:23.000Z

In my case, when I visited the site redacted.com, I got error
Fastly error: unknown domain: redacted.global.ssl.fastly.net. Please check blah blah blah.
Gone to Fastly.com -> CDN -> CDN services -> New service -> Domain: redacted.global.ssl.fastly.net.
It allowed me to add this as domain so I took over the domain.

;; ANSWER SECTION: elle.tw. 86400 IN A 151.101.128.200 elle.tw. 86400 IN A 151.101.192.200 elle.tw. 86400 IN A 151.101.0.200 elle.tw. 86400 IN A 151.101.64.200

;; ANSWER SECTION:
elle.tw. 86400 IN A 151.101.128.200
elle.tw. 86400 IN A 151.101.192.200
elle.tw. 86400 IN A 151.101.0.200
elle.tw. 86400 IN A 151.101.64.200