前言

国内的子域名接管漏洞比较少
今天遇到一个pagewiz的网站疑似存在子域名接管，然后去尝试了一下，失败了，所以觉得还是有必要先占个位，等以后遇到成功案例再写
image-20220225210723879

核心

copy自：https://github.com/EdOverflow/can-i-take-over-xyz

| Engine | Status | Fingerprint | Discussion | Documentation | | —- | —- | —- | —- | —- |

| Acquia | Not vulnerable | Web Site Not Found | Issue #103 | |

| Agile CRM | Vulnerable | Sorry, this page is no longer available. | Issue #145 | |

| Airee.ru | Vulnerable | | Issue #104 | |

| Anima | Vulnerable | If this is your website and you've just created it, try refreshing in a minute | Issue #126 | Anima Documentation |

| Akamai | Not vulnerable | | Issue #13 | |

| AWS/S3 | Vulnerable | The specified bucket does not exist | Issue #36 | |

| AWS/Load Balancer (ELB) | Not Vulnerable | status NXDOMAIN and CNAME pointing to XYZ.elb.amazonaws.com | Issue #137 | |

| Bitbucket | Vulnerable | Repository not found | | |

| Campaign Monitor | Vulnerable | Trying to access your account? | | Support Page |

| Cargo Collective | Vulnerable | 404 Not Found | Issue #152 | Cargo Support Page |

| Cloudfront | Not vulnerable | ViewerCertificateException | Issue #29 | Domain Security on Amazon CloudFront |

| Desk | Not vulnerable | Please try again or try Desk.com free for 14 days. | Issue #9 | |

| Digital Ocean | Vulnerable | Domain uses DO name serves with no records in DO. | | |

| Discourse | Vulnerable | | | Hackerone |

| Fastly | Edge case | Fastly error: unknown domain: | Issue #22 | |

| Feedpress | Not vulnerable | The feed has not been found. | Issue #80 | |

| Firebase | Not vulnerable | | Issue #128 | |

| Fly.io | Vulnerable | 404 Not Found | Issue #101 | |

| Freshdesk | Not vulnerable | We couldn't find servicedesk.victim.tld Maybe this is still fresh! You can claim it now at http://www.freshservice.com/signup | Issue #214 | Freshdesk Support Page |

| Gemfury | Vulnerable | 404: This page could not be found. | Issue #154 | Article |

| Ghost | Vulnerable | The thing you were looking for is no longer here, or never was | | |

| Github | Vulnerable | There isn't a GitHub Pages site here. | Issue #37 Issue #68 | |

| Gitlab | Not vulnerable | | HackerOne #312118 | |

| Google Cloud Storage | Not vulnerable | NoSuchBucketThe specified bucket does not exist. | | |

| HatenaBlog | vulnerable | 404 Blog is not found | | |

| Help Juice | Vulnerable | We could not find what you're looking for. | | Help Juice Support Page |

| Help Scout | Vulnerable | No settings were found for this company: | | HelpScout Docs |

| Heroku | Edge case | No such app | Issue #38 | |

| HubSpot | Not vulnerable | This page isn’t available | | |

| Instapage | Not vulnerable | | Issue #73 | |

| Intercom | Vulnerable | Uh oh. That page doesn't exist. | Issue #69 | Help center |

| JetBrains | Vulnerable | is not a registered InCloud YouTrack | | YouTrack InCloud Help Page |

| Key CDN | Not vulnerable | | Issue #112 | |

| Kinsta | Vulnerable | No Site For Domain | Issue #48 | kinsta-add-domain |

| Landingi | Edge case | It looks like you’re lost... | Issue #117 | |

| LaunchRock | Vulnerable | It looks like you may have taken a wrong turn somewhere. Don't worry...it happens to all of us. | Issue #74 | |

| Mashery | Edge Case | Unrecognized domain | HackerOne #275714, Issue #14 | |

| Microsoft Azure | Vulnerable | | Issue #35 | |

| Netlify | Edge Case | Not Found - Request ID: | Issue #40 | |

| Ngrok | Vulnerable | Tunnel *.ngrok.io not found | Issue #92 | Ngrok Documentation |

| Pantheon | Vulnerable | 404 error unknown site! | Issue #24 | Pantheon-Sub-takeover |

| Pingdom | Vulnerable | Sorry, couldn't find the status page | Issue #144 | Support Page |

| Readme.io | Vulnerable | Project doesnt exist... yet! | Issue #41 | |

| Sendgrid | Not vulnerable | | | |

| Shopify | Edge Case | Sorry, this shop is currently unavailable. | Issue #32, Issue #46 | Medium Article |

| Short.io | Vulnerable | Link does not exist | Issue #260 | |

| SmartJobBoard | Vulnerable | This job board website is either expired or its domain name is invalid. | Issue #139 | Support Page |

| Smartling | Edge Case | Domain is not configured | Issue #67 | |

| Squarespace | Not vulnerable | | | |

| Statuspage | Not Vulnerable | Status page pushed a DNS verification in order to prevent malicious takeovers what they mentioned in This Doc | PR #105 and PR #171 | Statuspage documentation |

| Strikingly | Vulnerable | page not found | Issue #58 | Strikingly-Sub-takeover |

| Surge.sh | Vulnerable | project not found | | Surge Documentation |

| Tumblr | Vulnerable | Whatever you were looking for doesn't currently exist at this address | Issue #240 | Tumblr Custom Domains |

| Tilda | Edge Case | Please renew your subscription | Issue #155PR #20 | |

| Uberflip | Vulnerable | Non-hub domain, The URL you've accessed does not provide a hub. | Issue #150 | Uberflip Documentation |

| Unbounce | Not Vulnerable | The requested URL was not found on this server. | Issue #11 | |

| Uptimerobot | Vulnerable | page not found | Issue #45 | Uptimerobot-Sub-takeover |

| UserVoice | Vulnerable | This UserVoice subdomain is currently available! | | |

| Webflow | Edge Case | The page you are looking for doesn't exist or has been moved. | Issue #44 | forum webflow |

| Wix | Edge Case | Looks Like This Domain Isn't Connected To A Website Yet! | Issue #231 | |

| Wordpress | Vulnerable | Do you want to register *.wordpress.com? | | |

| Worksites | Vulnerable | Hello! Sorry, but the website you’re looking for doesn’t exist. | Issue #142 | |

| WP Engine | Not vulnerable | | | |

| Zendesk | Not vulnerable | Help Center Closed | Issue #23 | Zendesk Support |

参考