edoverflow/can-i-take-over-xyz"¿Puedo tomar el control de XYZ?" — una lista de servicios y cómo reclamar (sub)dominios con registros DNS colgantes.
Los autores de este documento no asumen ninguna responsabilidad por la exactitud. Este proyecto solo está aquí para ayudar a guiar a los investigadores de seguridad a determinar si algo es vulnerable o no, pero no garantiza precisión. Este proyecto depende en gran medida de las contribuciones del público; por lo tanto, demostrar que algo es vulnerable queda a la entera discreción del investigador de seguridad y del programa de recompensas por errores.
Además, es importante aclarar que este proyecto no tiene como objetivo identificar o divulgar evasiones de las medidas de seguridad implementadas por varios servicios. En su lugar, se espera que dichas evasiones se informen directamente al servicio afectado para que tome las medidas adecuadas.
Finalmente, cabe señalar que algunos programas de recompensas por errores pueden aceptar informes de registros DNS pendientes sin requerir prueba de compromiso.
Las vulnerabilidades de toma de control de subdominio ocurren cuando un subdominio (subdominio.ejemplo.com) apunta a un servicio (por ejemplo, GitHub pages, Heroku, etc.) que ha sido eliminado o borrado. Esto permite a un atacante configurar una página en el servicio que se estaba utilizando y apuntar su página a ese subdominio. Por ejemplo, si subdominio.ejemplo.com apuntaba a una página de GitHub y el usuario decidió eliminar su página de GitHub, un atacante ahora puede crear una página de GitHub, agregar un archivo CNAME que contenga subdominio.ejemplo.com y reclamar subdominio.ejemplo.com.
Puedes leer más sobre las tomas de control de subdominio aquí:
Según la experiencia personal, reclamar el subdominio de forma discreta y servir un archivo inofensivo en una página oculta suele ser suficiente para demostrar la vulnerabilidad de seguridad. No sirvas contenido en la página de índice. Una buena prueba de concepto podría consistir en un comentario HTML servido a través de una ruta aleatoria:``` $ cat aelfjj1or81uegj9ea8z31zro.html
Tenga en cuenta que esto depende del programa de recompensas por errores al que esté apuntando. En caso de duda, consulte la política de seguridad del programa de recompensas y/o solicite aclaraciones al equipo detrás del programa.
## Cómo usar este proyecto
Recomiendo buscar el nombre del servicio al que está apuntando en la pestaña de issues. Así podrá ver la discusión en curso y los pasos más detallados sobre cómo reclamar el subdominio que busca.
## Cómo contribuir
Puede enviar nuevos servicios aquí: https://github.com/EdOverflow/can-i-take-over-xyz/issues/new?template=new-entry.md.
Una lista de servicios que se pueden verificar (aunque primero verifique si hay duplicados en esta lista) se puede encontrar aquí: https://github.com/EdOverflow/can-i-take-over-xyz/issues/26.
# Todas las entradas
Nota: `fingerprints.json` se actualiza automáticamente según el contenido de esta tabla.
Definiciones de encabezados de columna:
- `Motor`: Nombre del servicio
- `Estado`: Si el servicio es vulnerable
- `Verificado por CI/CD`: Si la verificación automatizada de huellas está pasando actualmente
- `Dominios`: Dominios separados por comas (utilizados para la verificación automática de huellas)
- `Huella`: Expresión regular que indica página vulnerable (o `NXDOMAIN`, que indica registro DNS inexistente)
- `Discusión`: Enlace al issue en este repositorio para discusión
- `Documentación`: Enlace a la documentación oficial
<!--FINGERPRINTS-->| Motor | Estado | Verificado por CI/CD | Dominios | Huella digital | Discusión | Documentación |
| ----------------------- | -------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWS/Elastic Beanstalk | Vulnerable | 🟩 | elasticbeanstalk.com | `NXDOMAIN` | [Issue #194](https://github.com/EdOverflow/can-i-take-over-xyz/issues/194) | |
| AWS/Load Balancer (ELB) | No vulnerable | 🟥 | elb.amazonaws.com | `NXDOMAIN` | [Issue #137](https://github.com/EdOverflow/can-i-take-over-xyz/issues/137) | |
| AWS/S3 | Vulnerable | 🟩 | s3.amazonaws.com | `The specified bucket does not exist` | [Issue #36](https://github.com/EdOverflow/can-i-take-over-xyz/issues/36) | |
| Acquia | No vulnerable | 🟥 | | `Web Site Not Found` | [Issue #103](https://github.com/EdOverflow/can-i-take-over-xyz/issues/103) | |
| Agile CRM | Vulnerable | 🟥 | agilecrm.com | `Sorry, this page is no longer available.` | [Issue #145](https://github.com/EdOverflow/can-i-take-over-xyz/issues/145) | |
| Airee.ru | Vulnerable | 🟩 | airee.ru | `Ошибка 402. Сервис Айри.рф не оплачен` | [Issue #104](https://github.com/EdOverflow/can-i-take-over-xyz/issues/104) | |
| Akamai | No vulnerable | 🟥 | | | [Issue #13](https://github.com/EdOverflow/can-i-take-over-xyz/issues/13) | |
| Anima | Vulnerable | 🟩 | animaapp.io | `The page you were looking for does not exist.` | [Issue #126](https://github.com/EdOverflow/can-i-take-over-xyz/issues/126) | [Documentación de Anima](https://docs.animaapp.com/v1/launchpad/08-custom-domain.html) |
| Bitbucket | Vulnerable | 🟩 | bitbucket.io | `Repository not found` | [Issue #97](https://github.com/EdOverflow/can-i-take-over-xyz/issues/97) | |
| Campaign Monitor | Vulnerable | 🟥 | | `Trying to access your account?` | [Issue #275](https://github.com/EdOverflow/can-i-take-over-xyz/issues/275) | [Página de soporte](https://help.campaignmonitor.com/custom-domain-names) |
| Canny | Vulnerable | 🟥 | | `Company Not Found` `There is no such company. Did you enter the right URL?` | [Issue #114](https://github.com/EdOverflow/can-i-take-over-xyz/issues/114) | |
| Cargo Collective | Vulnerable | 🟥 | | `404 Not Found` | [Issue #152](https://github.com/EdOverflow/can-i-take-over-xyz/issues/152) | [Página de soporte de Cargo](https://support.2.cargocollective.com/Using-a-Third-Party-Domain) |
| Cloudfront | No vulnerable | 🟥 | | `ViewerCertificateException` | [Issue #29](https://github.com/EdOverflow/can-i-take-over-xyz/issues/29) | [Seguridad de dominio en Amazon CloudFront](https://aws.amazon.com/blogs/networking-and-content-delivery/continually-enhancing-domain-security-on-amazon-cloudfront/) |
| Desk | No vulnerable | 🟥 | | `Please try again or try Desk.com free for 14 days.` | [Issue #9](https://github.com/EdOverflow/can-i-take-over-xyz/issues/9) | |
| Digital Ocean | Vulnerable | 🟥 | | `Domain uses DO name servers with no records in DO.` | | |
| Discourse | Vulnerable | 🟩 | trydiscourse.com | `NXDOMAIN` | [Issue #49](https://github.com/EdOverflow/can-i-take-over-xyz/issues/49) | [HackerOne](https://hackerone.com/reports/264494) |
| Dreamhost | No vulnerable | 🟥 | | `Site Not Found Well, this is awkward. The site you're looking for is not here.` | [Issue #153](https://github.com/EdOverflow/can-i-take-over-xyz/issues/153) [Issue #5](https://github.com/shifa123/Can-I-take-over-xyz-v2/issues/5v) | |
| Fastly | No vulnerable | 🟥 | | `Fastly error: unknown domain:` | [Issue #22](https://github.com/EdOverflow/can-i-take-over-xyz/issues/22) | |
| Feedpress | No vulnerable | 🟥 | | `The feed has not been found.` | [Issue #80](https://github.com/EdOverflow/can-i-take-over-xyz/issues/80) | |
| Firebase | No vulnerable | 🟥 | | | [Issue #128](https://github.com/EdOverflow/can-i-take-over-xyz/issues/128) | |
| Fly.io | No vulnerable | 🟥 | | `404 Not Found` | [Issue #101](https://github.com/EdOverflow/can-i-take-over-xyz/issues/101) | |
| Freshdesk | No vulnerable | 🟥 | | `We couldn't find servicedesk.victim.tld Maybe this is still fresh! You can claim it now at http://www.freshservice.com/signup` | [Issue #214](https://github.com/EdOverflow/can-i-take-over-xyz/issues/214) | [Página de soporte de Freshdesk](https://support.freshdesk.com/support/solutions/articles/37590-using-a-vanity-support-url-and-pointing-the-cname) |
| Frontify | Caso límite | 🟥 | | `404 - Page Not Found` `Oops… looks like you got lost` | [Issue #170](https://github.com/EdOverflow/can-i-take-over-xyz/issues/170) | |
| Gemfury | Vulnerable | 🟥 | furyns.com | `404: This page could not be found.` | [Issue #154](https://github.com/EdOverflow/can-i-take-over-xyz/issues/154) | [Artículo](https://khaledibnalwalid.wordpress.com/2020/06/25/gemfury-subdomain-takeover/) |
| Getresponse | Vulnerable | 🟥 | | `With GetResponse Landing Pages, lead generation has never been easier` | [Issue #235](https://github.com/EdOverflow/can-i-take-over-xyz/issues/235) | |
| Ghost | Vulnerable | 🟥 | ghost.io | `Site unavailable\.|Failed to resolve DNS path for this host` | [Issue #89](https://github.com/EdOverflow/can-i-take-over-xyz/issues/89) | |
| Github | Caso límite | 🟥 | | `There isn't a GitHub Pages site here.` | [Issue #37](https://github.com/EdOverflow/can-i-take-over-xyz/issues/37) [Issue #68](https://github.com/EdOverflow/can-i-take-over-xyz/issues/68) | |
| Gitlab | No vulnerable | 🟥 | | | [HackerOne #312118](https://hackerone.com/reports/312118) | |
| Google Cloud Storage | No vulnerable | 🟥 | | `<?xml version='1.0' encoding='UTF-8'?><Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist.</Message></Error>` | | |
| Google Sites | No vulnerable | 🟥 | | `The requested URL was not found on this server. That’s all we know.` | [Issue #277](https://github.com/EdOverflow/can-i-take-over-xyz/issues/277) | [Soporte de Google](https://support.google.com/webmasters/answer/9008080?visit_id=637981741431097680-3818919062&rd=2) |
| HatenaBlog | Vulnerable | 🟩 | hatenablog.com | `404 Blog is not found` | | |
| Help Juice | Vulnerable | 🟩 | helpjuice.com | `We could not find what you're looking for.` | | [Página de soporte de Help Juice](https://help.helpjuice.com/en_US/using-your-custom-domain/how-to-set-up-a-custom-domain) |
| Help Scout | Vulnerable | 🟩 | helpscoutdocs.com | `No settings were found for this company:` | | [Documentación de HelpScout](https://docs.helpscout.net/article/42-setup-custom-domain) |
| Helprace | Vulnerable | 🟩 | helprace.com | `HTTP_STATUS=301` | [Issue #115](https://github.com/EdOverflow/can-i-take-over-xyz/issues/115) | |
| Heroku | Caso límite | 🟥 | | `No such app` | [Issue #38](https://github.com/EdOverflow/can-i-take-over-xyz/issues/38) | |
| HubSpot | No vulnerable | 🟥 | | `This page isn't available` | [Issue #59](https://github.com/EdOverflow/can-i-take-over-xyz/issues/59) | |
| Instapage | No vulnerable | 🟥 | | | [Issue #73](https://github.com/EdOverflow/can-i-take-over-xyz/issues/73) | |
| Intercom | Caso límite | 🟥 | | `Uh oh. That page doesn't exist.` | [Issue #69](https://github.com/EdOverflow/can-i-take-over-xyz/issues/69) | [Centro de ayuda](https://www.intercom.com/help/) |
| JetBrains | Vulnerable | 🟥 | youtrack.cloud | `is not a registered InCloud YouTrack` | [PR #107](https://github.com/EdOverflow/can-i-take-over-xyz/pull/107) | [Página de ayuda de YouTrack InCloud](https://www.jetbrains.com/help/youtrack/incloud/Domain-Settings.html) |
| Key CDN | No vulnerable | 🟥 | | | [Issue #112](https://github.com/EdOverflow/can-i-take-over-xyz/issues/112) | |
| Kinsta | No vulnerable | 🟥 | | `No Site For Domain` | [Issue #48](https://github.com/EdOverflow/can-i-take-over-xyz/issues/48) | [kinsta-add-domain](https://kinsta.com/knowledgebase/add-domain/) |
| Landingi | Caso límite | 🟥 | | `It looks like you’re lost...` | [Issue #117](https://github.com/EdOverflow/can-i-take-over-xyz/issues/117) | |
| LaunchRock | Vulnerable | 🟥 | launchrock.com | `HTTP_STATUS=500` | [Issue #74](https://github.com/EdOverflow/can-i-take-over-xyz/issues/74) | |
| Mailchimp | No vulnerable | 🟥 | | `We can't find that page It looks like you're trying to reach a page that was built by Mailchimp but is no longer active.` | [Discusión #250](https://github.com/EdOverflow/can-i-take-over-xyz/discussions/250) | |
| Mashery | Caso límite | 🟥 | | `Unrecognized domain` | [Issue #14](https://github.com/EdOverflow/can-i-take-over-xyz/issues/14) | [HackerOne](https://hackerone.com/reports/275714) |
| Microsoft Azure | Vulnerable | 🟩 | cloudapp.net, cloudapp.azure.com, azurewebsites.net, blob.core.windows.net, cloudapp.azure.com, azure-api.net, azurehdinsight.net, azureedge.net, azurecontainer.io, database.windows.net, azuredatalakestore.net, search.windows.net, azurecr.io, redis.cache.windows.net, azurehdinsight.net, servicebus.windows.net, visualstudio.com | `NXDOMAIN` | [Issue #35](https://github.com/EdOverflow/can-i-take-over-xyz/issues/35) | |
| Netlify | Caso límite | 🟥 | | `Not Found - Request ID:` | [Issue #40](https://github.com/EdOverflow/can-i-take-over-xyz/issues/40) | |
| Ngrok | Vulnerable | 🟥 | ngrok.io | `Tunnel .*.ngrok.io not found` | [Issue #92](https://github.com/EdOverflow/can-i-take-over-xyz/issues/92) | [Documentación de Ngrok](https://ngrok.com/docs#http-custom-domains) |
| Pantheon | Vulnerable | 🟥 | | `404 error unknown site!` | [Issue #24](https://github.com/EdOverflow/can-i-take-over-xyz/issues/24) | [Documentación](https://pantheon.io/docs/guides/domains/custom-domains) [Pantheon-Sub-takeover](https://medium.com/@hussain_0x3c/hostile-subdomain-takeover-using-pantheon-ebf4ab813111) |
| Pingdom | Vulnerable | 🟥 | | `Sorry, couldn't find the status page` | [Issue #144](https://github.com/EdOverflow/can-i-take-over-xyz/issues/144) | [Página de soporte](https://help.pingdom.com/hc/en-us/articles/205386171-Public-Status-Page) |
| Readme.io | Vulnerable | 🟥 | readme.io | `The creators of this project are still working on making everything perfect!` | [Issue #41](https://github.com/EdOverflow/can-i-take-over-xyz/issues/41) | |
| Readthedocs | Vulnerable | 🟥 | | `The link you have followed or the URL that you entered does not exist.` | [Issue #160](https://github.com/EdOverflow/can-i-take-over-xyz/issues/160) | |
| Sendgrid | No vulnerable | 🟥 | | | | |
| Shopify | Caso límite | 🟥 | | `Sorry, this shop is currently unavailable.` | [Issue #32](https://github.com/EdOverflow/can-i-take-over-xyz/issues/32) [Issue #46](https://github.com/EdOverflow/can-i-take-over-xyz/issues/46) | [Medium Article](https://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75) |
| Short.io | Vulnerable | 🟥 | | `Link does not exist` | [Issue #260](https://github.com/EdOverflow/can-i-take-over-xyz/issues/260) | |
| SmartJobBoard | Vulnerable | 🟩 | 52.16.160.97 | `This job board website is either expired or its domain name is invalid.` | [Issue #139](https://github.com/EdOverflow/can-i-take-over-xyz/issues/139) | [Página de soporte](https://help.smartjobboard.com/en/articles/1269655-connecting-a-custom-domain-name) |
| Smartling | Caso límite | 🟥 | | `Domain is not configured` | [Issue #67](https://github.com/EdOverflow/can-i-take-over-xyz/issues/67) | |
| Smugsmug | Vulnerable | 🟥 | | | [Issue #60](https://github.com/EdOverflow/can-i-take-over-xyz/issues/60) | |
| Squarespace | No vulnerable | 🟥 | | | | |
| Statuspage | No vulnerable | 🟥 | | | La página de estado impulsó una verificación DNS para prevenir tomas maliciosas, como lo mencionaron en [Este documento](https://support.atlassian.com/statuspage/docs/configure-your-dns/) [PR #105](https://github.com/EdOverflow/can-i-take-over-xyz/pull/105) [PR #171](https://github.com/EdOverflow/can-i-take-over-xyz/pull/171) | [Documentación de Statuspage](https://help.statuspage.io/knowledge_base/topics/domain-ownership) |
| Strikingly | Vulnerable | 🟩 | s.strikinglydns.com | `PAGE NOT FOUND.` | [Issue #58](https://github.com/EdOverflow/can-i-take-over-xyz/issues/58) | [Strikingly-Sub-takeover](https://medium.com/@sherif0x00/takeover-subdomains-pointing-to-strikingly-5e67df80cdfd) |
| Surge.sh | Vulnerable | 🟩 | na-west1.surge.sh | `project not found` | [Issue #198](https://github.com/EdOverflow/can-i-take-over-xyz/issues/198) | [Documentación de Surge](https://surge.sh/help/adding-a-custom-domain) |
| SurveySparrow | Vulnerable | 🟩 | surveysparrow.com | `Account not found.` | [Issue #281](https://github.com/EdOverflow/can-i-take-over-xyz/issues/281) | [Dominio personalizado](https://help.surveysparrow.com/custom-domain) |
| Tilda | Caso límite | 🟥 | | `Please renew your subscription` | [Issue #155](https://github.com/EdOverflow/can-i-take-over-xyz/issues/155) [PR #20](https://github.com/EdOverflow/can-i-take-over-xyz/pull/20) | |
| Tumblr | Caso límite | 🟥 | | `Whatever you were looking for doesn't currently exist at this address` | [Issue #240](https://github.com/EdOverflow/can-i-take-over-xyz/issues/240) | [Dominios personalizados de Tumblr](https://www.tumblr.com/docs/en/custom_domains) |
| Uberflip | Vulnerable | 🟩 | read.uberflip.com | `The URL you've accessed does not provide a hub.` | [Issue #150](https://github.com/EdOverflow/can-i-take-over-xyz/issues/150) | [Documentación de Uberflip](https://help.uberflip.com/hc/en-us/articles/360018786372-Custom-Domain-Set-up-Your-Hub-on-a-Subdomain) |
| Unbounce | No vulnerable | 🟥 | | `The requested URL was not found on this server.` | [Issue #11](https://github.com/EdOverflow/can-i-take-over-xyz/issues/11) | |
| Uptimerobot | Vulnerable | 🟥 | stats.uptimerobot.com | `page not found` | [Issue #45](https://github.com/EdOverflow/can-i-take-over-xyz/issues/45) | [Uptimerobot-Sub-takeover](https://exploit.linuxsec.org/uptimerobot-com-custom-domain-subdomain-takeover/) |
| UserVoice | No vulnerable | 🟥 | | `This UserVoice subdomain is currently available!` | [Issue #163](https://github.com/EdOverflow/can-i-take-over-xyz/issues/163) | |
| Vercel | Caso límite | 🟥 | https://nonexistent-example.vercel.com/ | `DEPLOYMENT_NOT_FOUND.` | [Issue #183](https://github.com/EdOverflow/can-i-take-over-xyz/issues/183) | [Añadiendo y configurando un dominio personalizado](https://vercel.com/docs/concepts/projects/domains/add-a-domain) |
| WP Engine | No vulnerable | 🟥 | | | | |
| Webflow | Caso límite | 🟥 | | `The page you are looking for doesn't exist or has been moved.` | [Issue #44](https://github.com/EdOverflow/can-i-take-over-xyz/issues/44) | [foro de webflow](https://forum.webflow.com/t/hosting-a-subdomain-on-webflow/59201) |
| Wix | Caso límite | 🟥 | | `Looks Like This Domain Isn't Connected To A Website Yet!` | [Issue #231](https://github.com/EdOverflow/can-i-take-over-xyz/issues/231) | |
| Wordpress | Vulnerable | 🟩 | wordpress.com | `Do you want to register .*.wordpress.com?` | [PR #176](https://github.com/EdOverflow/can-i-take-over-xyz/pull/176) | |
| Worksites | Vulnerable | 🟩 | worksites.net, 69.164.223.206 | `Hello! Sorry, but the website you’re looking for doesn’t exist.` | [Issue #142](https://github.com/EdOverflow/can-i-take-over-xyz/issues/142) | |
| Zendesk | No vulnerable | 🟥 | | `Help Center Closed` | [Issue #23](https://github.com/EdOverflow/can-i-take-over-xyz/issues/23) | [Soporte de Zendesk](https://support.zendesk.com/hc/en-us/articles/203664356-Changing-the-address-of-your-Help-Center-subdomain-host-mapping-) |<!--FINGERPRINTS-->