本文档的作者对内容的正确性不承担任何责任。本项目仅用于帮助安全研究人员判断某资源是否存在漏洞，但不保证准确性。本项目严重依赖社区贡献；因此，证明某资源存在漏洞最终由安全研究人员和漏洞赏金计划自行决定。
此外，需要明确的是，本项目的目的并非识别或披露针对各种服务安全措施的绕过方法。相反，此类绕过方法应直接报告给受影响的服务，以便采取适当措施。
最后，值得注意的是，某些漏洞赏金计划可能直接接受悬空DNS记录报告，而不要求提供被利用的证据。
子域名接管漏洞是指当某个子域名（subdomain.example.com）指向一个已被删除或移除的服务（例如 GitHub Pages、Heroku 等）时产生的漏洞。这使攻击者能够在该服务上创建一个页面，并将其指向该子域名。例如，如果 subdomain.example.com 指向某个 GitHub 页面，而用户决定删除该 GitHub 页面，攻击者就可以创建一个新的 GitHub 页面，添加一个包含 subdomain.example.com 的 CNAME 文件，从而声明对该子域名的所有权。
你可以在这里了解更多关于子域名接管的内容：
根据个人经验，谨慎地声明对该子域名的所有权，并在隐藏页面上提供一个无害文件，通常足以演示该安全漏洞。不要在索引页面上提供内容。一个好的概念验证可以是通过随机路径提供的 HTML 注释：``` $ cat aelfjj1or81uegj9ea8z31zro.html
请注意，这取决于您所针对的漏洞赏金计划。如有疑问，请参考漏洞赏金计划的安全策略和/或向该计划背后的团队请求澄清。
## 如何使用本项目
我建议在issues选项卡中搜索您所针对的服务名称。这样您可以看到正在进行的讨论以及关于如何认领您所追求的域名的更详细步骤。
## 如何贡献
您可以在此处提交新服务：https://github.com/EdOverflow/can-i-take-over-xyz/issues/new?template=new-entry.md。
可供检查的服务列表（但请先对照此列表检查是否有重复）可在此处找到：https://github.com/EdOverflow/can-i-take-over-xyz/issues/26。
# 所有条目
注意：`fingerprints.json` 会根据此表的内容自动更新。
列标题定义：
- `Engine`：服务名称
- `Status`：服务是否易受攻击
- `Verified by CI/CD`：自动指纹检查是否当前通过
- `Domains`：逗号分隔的域名（用于指纹自动验证）
- `Fingerprint`：指示易受攻击页面的正则表达式（或 `NXDOMAIN`，表示不存在的DNS记录）
- `Discussion`：指向本仓库中讨论问题的链接
- `Documentation`：指向官方文档的链接
<!--FINGERPRINTS-->| 引擎 | 状态 | 经 CI/CD 验证 | 域名 | 指纹 | 讨论 | 文档 |
| ----------------------- | -------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWS/Elastic Beanstalk | 存在漏洞 | 🟩 | elasticbeanstalk.com | `NXDOMAIN` | [Issue #194](https://github.com/EdOverflow/can-i-take-over-xyz/issues/194) | |
| AWS/Load Balancer (ELB) | 无漏洞 | 🟥 | elb.amazonaws.com | `NXDOMAIN` | [Issue #137](https://github.com/EdOverflow/can-i-take-over-xyz/issues/137) | |
| AWS/S3 | 存在漏洞 | 🟩 | s3.amazonaws.com | `The specified bucket does not exist` | [Issue #36](https://github.com/EdOverflow/can-i-take-over-xyz/issues/36) | |
| Acquia | 无漏洞 | 🟥 | | `Web Site Not Found` | [Issue #103](https://github.com/EdOverflow/can-i-take-over-xyz/issues/103) | |
| Agile CRM | 存在漏洞 | 🟥 | agilecrm.com | `Sorry, this page is no longer available.` | [Issue #145](https://github.com/EdOverflow/can-i-take-over-xyz/issues/145) | |
| Airee.ru | 存在漏洞 | 🟩 | airee.ru | `Ошибка 402. Сервис Айри.рф не оплачен` | [Issue #104](https://github.com/EdOverflow/can-i-take-over-xyz/issues/104) | |
| Akamai | 无漏洞 | 🟥 | | | [Issue #13](https://github.com/EdOverflow/can-i-take-over-xyz/issues/13) | |
| Anima | 存在漏洞 | 🟩 | animaapp.io | `The page you were looking for does not exist.` | [Issue #126](https://github.com/EdOverflow/can-i-take-over-xyz/issues/126) | [Anima 文档](https://docs.animaapp.com/v1/launchpad/08-custom-domain.html) |
| Bitbucket | 存在漏洞 | 🟩 | bitbucket.io | `Repository not found` | [Issue #97](https://github.com/EdOverflow/can-i-take-over-xyz/issues/97) | |
| Campaign Monitor | 存在漏洞 | 🟥 | | `Trying to access your account?` | [Issue #275](https://github.com/EdOverflow/can-i-take-over-xyz/issues/275) | [支持页面](https://help.campaignmonitor.com/custom-domain-names) |
| Canny | 存在漏洞 | 🟥 | | `Company Not Found` `There is no such company. Did you enter the right URL?` | [Issue #114](https://github.com/EdOverflow/can-i-take-over-xyz/issues/114) | |
| Cargo Collective | 存在漏洞 | 🟥 | | `404 Not Found` | [Issue #152](https://github.com/EdOverflow/can-i-take-over-xyz/issues/152) | [Cargo 支持页面](https://support.2.cargocollective.com/Using-a-Third-Party-Domain) |
| Cloudfront | 无漏洞 | 🟥 | | `ViewerCertificateException` | [Issue #29](https://github.com/EdOverflow/can-i-take-over-xyz/issues/29) | [Amazon CloudFront 域名安全](https://aws.amazon.com/blogs/networking-and-content-delivery/continually-enhancing-domain-security-on-amazon-cloudfront/) |
| Desk | 无漏洞 | 🟥 | | `Please try again or try Desk.com free for 14 days.` | [Issue #9](https://github.com/EdOverflow/can-i-take-over-xyz/issues/9) | |
| Digital Ocean | 存在漏洞 | 🟥 | | `Domain uses DO name servers with no records in DO.` | | |
| Discourse | 存在漏洞 | 🟩 | trydiscourse.com | `NXDOMAIN` | [Issue #49](https://github.com/EdOverflow/can-i-take-over-xyz/issues/49) | [Hackerone](https://hackerone.com/reports/264494) |
| Dreamhost | 无漏洞 | 🟥 | | `Site Not Found Well, this is awkward. The site you're looking for is not here.` | [Issue #153](https://github.com/EdOverflow/can-i-take-over-xyz/issues/153) [Issue #5](https://github.com/shifa123/Can-I-take-over-xyz-v2/issues/5v) | |
| Fastly | 无漏洞 | 🟥 | | `Fastly error: unknown domain:` | [Issue #22](https://github.com/EdOverflow/can-i-take-over-xyz/issues/22) | |
| Feedpress | 无漏洞 | 🟥 | | `The feed has not been found.` | [Issue #80](https://github.com/EdOverflow/can-i-take-over-xyz/issues/80) | |
| Firebase | 无漏洞 | 🟥 | | | [Issue #128](https://github.com/EdOverflow/can-i-take-over-xyz/issues/128) | |
| Fly.io | 无漏洞 | 🟥 | | `404 Not Found` | [Issue #101](https://github.com/EdOverflow/can-i-take-over-xyz/issues/101) | |
| Freshdesk | 无漏洞 | 🟥 | | `We couldn't find servicedesk.victim.tld Maybe this is still fresh! You can claim it now at http://www.freshservice.com/signup` | [Issue #214](https://github.com/EdOverflow/can-i-take-over-xyz/issues/214) | [Freshdesk 支持页面](https://support.freshdesk.com/support/solutions/articles/37590-using-a-vanity-support-url-and-pointing-the-cname) |
| Frontify | 边界情况 | 🟥 | | `404 - Page Not Found` `Oops… looks like you got lost` | [Issue #170](https://github.com/EdOverflow/can-i-take-over-xyz/issues/170) | |
| Gemfury | 存在漏洞 | 🟥 | furyns.com | `404: This page could not be found.` | [Issue #154](https://github.com/EdOverflow/can-i-take-over-xyz/issues/154) | [文章](https://khaledibnalwalid.wordpress.com/2020/06/25/gemfury-subdomain-takeover/) |
| Getresponse | 存在漏洞 | 🟥 | | `With GetResponse Landing Pages, lead generation has never been easier` | [Issue #235](https://github.com/EdOverflow/can-i-take-over-xyz/issues/235) | |
| Ghost | 存在漏洞 | 🟥 | ghost.io | `Site unavailable\.|Failed to resolve DNS path for this host` | [Issue #89](https://github.com/EdOverflow/can-i-take-over-xyz/issues/89) | |
| Github | 边界情况 | 🟥 | | `There isn't a GitHub Pages site here.` | [Issue #37](https://github.com/EdOverflow/can-i-take-over-xyz/issues/37) [Issue #68](https://github.com/EdOverflow/can-i-take-over-xyz/issues/68) | |
| Gitlab | 无漏洞 | 🟥 | | | [HackerOne #312118](https://hackerone.com/reports/312118) | |
| Google Cloud Storage | 无漏洞 | 🟥 | | `<?xml version='1.0' encoding='UTF-8'?><Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist.</Message></Error>` | | |
| Google Sites | 无漏洞 | 🟥 | | `The requested URL was not found on this server. That’s all we know.` | [Issue #277](https://github.com/EdOverflow/can-i-take-over-xyz/issues/277) | [Google 帮助](https://support.google.com/webmasters/answer/9008080?visit_id=637981741431097680-3818919062&rd=2) |
| HatenaBlog | 存在漏洞 | 🟩 | hatenablog.com | `404 Blog is not found` | | |
| Help Juice | 存在漏洞 | 🟩 | helpjuice.com | `We could not find what you're looking for.` | | [Help Juice 支持页面](https://help.helpjuice.com/en_US/using-your-custom-domain/how-to-set-up-a-custom-domain) |
| Help Scout | 存在漏洞 | 🟩 | helpscoutdocs.com | `No settings were found for this company:` | | [HelpScout 文档](https://docs.helpscout.net/article/42-setup-custom-domain) |
| Helprace | 存在漏洞 | 🟩 | helprace.com | `HTTP_STATUS=301` | [Issue #115](https://github.com/EdOverflow/can-i-take-over-xyz/issues/115) | |
| Heroku | 边界情况 | 🟥 | | `No such app` | [Issue #38](https://github.com/EdOverflow/can-i-take-over-xyz/issues/38) | |
| HubSpot | 无漏洞 | 🟥 | | `This page isn't available` | [Issue #59](https://github.com/EdOverflow/can-i-take-over-xyz/issues/59) | |
| Instapage | 无漏洞 | 🟥 | | | [Issue #73](https://github.com/EdOverflow/can-i-take-over-xyz/issues/73) | |
| Intercom | 边界情况 | 🟥 | | `Uh oh. That page doesn't exist.` | [Issue #69](https://github.com/EdOverflow/can-i-take-over-xyz/issues/69) | [帮助中心](https://www.intercom.com/help/) |
| JetBrains | 存在漏洞 | 🟥 | youtrack.cloud | `is not a registered InCloud YouTrack` | [PR #107](https://github.com/EdOverflow/can-i-take-over-xyz/pull/107) | [YouTrack InCloud 帮助页面](https://www.jetbrains.com/help/youtrack/incloud/Domain-Settings.html) |
| Key CDN | 无漏洞 | 🟥 | | | [Issue #112](https://github.com/EdOverflow/can-i-take-over-xyz/issues/112) | |
| Kinsta | 无漏洞 | 🟥 | | `No Site For Domain` | [Issue #48](https://github.com/EdOverflow/can-i-take-over-xyz/issues/48) | [kinsta-add-domain](https://kinsta.com/knowledgebase/add-domain/) |
| Landingi | 边界情况 | 🟥 | | `It looks like you’re lost...` | [Issue #117](https://github.com/EdOverflow/can-i-take-over-xyz/issues/117) | |
| LaunchRock | 存在漏洞 | 🟥 | launchrock.com | `HTTP_STATUS=500` | [Issue #74](https://github.com/EdOverflow/can-i-take-over-xyz/issues/74) | |
| Mailchimp | 无漏洞 | 🟥 | | `We can't find that page It looks like you're trying to reach a page that was built by Mailchimp but is no longer active.` | [Discussion #250](https://github.com/EdOverflow/can-i-take-over-xyz/discussions/250) | |
| Mashery | 边界情况 | 🟥 | | `Unrecognized domain` | [Issue #14](https://github.com/EdOverflow/can-i-take-over-xyz/issues/14) | [HackerOne](https://hackerone.com/reports/275714) |
| Microsoft Azure | 存在漏洞 | 🟩 | cloudapp.net, cloudapp.azure.com, azurewebsites.net, blob.core.windows.net, cloudapp.azure.com, azure-api.net, azurehdinsight.net, azureedge.net, azurecontainer.io, database.windows.net, azuredatalakestore.net, search.windows.net, azurecr.io, redis.cache.windows.net, azurehdinsight.net, servicebus.windows.net, visualstudio.com | `NXDOMAIN` | [Issue #35](https://github.com/EdOverflow/can-i-take-over-xyz/issues/35) | |
| Netlify | 边界情况 | 🟥 | | `Not Found - Request ID:` | [Issue #40](https://github.com/EdOverflow/can-i-take-over-xyz/issues/40) | |
| Ngrok | 存在漏洞 | 🟥 | ngrok.io | `Tunnel .*.ngrok.io not found` | [Issue #92](https://github.com/EdOverflow/can-i-take-over-xyz/issues/92) | [Ngrok 文档](https://ngrok.com/docs#http-custom-domains) |
| Pantheon | 存在漏洞 | 🟥 | | `404 error unknown site!` | [Issue #24](https://github.com/EdOverflow/can-i-take-over-xyz/issues/24) | [文档](https://pantheon.io/docs/guides/domains/custom-domains) [Pantheon-Sub-takeover](https://medium.com/@hussain_0x3c/hostile-subdomain-takeover-using-pantheon-ebf4ab813111) |
| Pingdom | 存在漏洞 | 🟥 | | `Sorry, couldn't find the status page` | [Issue #144](https://github.com/EdOverflow/can-i-take-over-xyz/issues/144) | [支持页面](https://help.pingdom.com/hc/en-us/articles/205386171-Public-Status-Page) |
| Readme.io | 存在漏洞 | 🟥 | readme.io | `The creators of this project are still working on making everything perfect!` | [Issue #41](https://github.com/EdOverflow/can-i-take-over-xyz/issues/41) | |
| Readthedocs | 存在漏洞 | 🟥 | | `The link you have followed or the URL that you entered does not exist.` | [Issue #160](https://github.com/EdOverflow/can-i-take-over-xyz/issues/160) | |
| Sendgrid | 无漏洞 | 🟥 | | | | |
| Shopify | 边界情况 | 🟥 | | `Sorry, this shop is currently unavailable.` | [Issue #32](https://github.com/EdOverflow/can-i-take-over-xyz/issues/32) [Issue #46](https://github.com/EdOverflow/can-i-take-over-xyz/issues/46) | [Medium 文章](https://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75) |
| Short.io | 存在漏洞 | 🟥 | | `Link does not exist` | [Issue #260](https://github.com/EdOverflow/can-i-take-over-xyz/issues/260) | |
| SmartJobBoard | 存在漏洞 | 🟩 | 52.16.160.97 | `This job board website is either expired or its domain name is invalid.` | [Issue #139](https://github.com/EdOverflow/can-i-take-over-xyz/issues/139) | [支持页面](https://help.smartjobboard.com/en/articles/1269655-connecting-a-custom-domain-name) |
| Smartling | 边界情况 | 🟥 | | `Domain is not configured` | [Issue #67](https://github.com/EdOverflow/can-i-take-over-xyz/issues/67) | |
| Smugsmug | 存在漏洞 | 🟥 | | | [Issue #60](https://github.com/EdOverflow/can-i-take-over-xyz/issues/60) | |
| Squarespace | 无漏洞 | 🟥 | | | | |
| Statuspage | 无漏洞 | 🟥 | | | Status 页面推送了 DNS 验证以防止恶意接管，详见 [此文档](https://support.atlassian.com/statuspage/docs/configure-your-dns/) [PR #105](https://github.com/EdOverflow/can-i-take-over-xyz/pull/105) [PR #171](https://github.com/EdOverflow/can-i-take-over-xyz/pull/171) | [Statuspage 文档](https://help.statuspage.io/knowledge_base/topics/domain-ownership) |
| Strikingly | 存在漏洞 | 🟩 | s.strikinglydns.com | `PAGE NOT FOUND.` | [Issue #58](https://github.com/EdOverflow/can-i-take-over-xyz/issues/58) | [Strikingly-Sub-takeover](https://medium.com/@sherif0x00/takeover-subdomains-pointing-to-strikingly-5e67df80cdfd) |
| Surge.sh | 存在漏洞 | 🟩 | na-west1.surge.sh | `project not found` | [Issue #198](https://github.com/EdOverflow/can-i-take-over-xyz/issues/198) | [Surge 文档](https://surge.sh/help/adding-a-custom-domain) |
| SurveySparrow | 存在漏洞 | 🟩 | surveysparrow.com | `Account not found.` | [Issue #281](https://github.com/EdOverflow/can-i-take-over-xyz/issues/281) | [自定义域名](https://help.surveysparrow.com/custom-domain) |
| Tilda | 边界情况 | 🟥 | | `Please renew your subscription` | [Issue #155](https://github.com/EdOverflow/can-i-take-over-xyz/issues/155) [PR #20](https://github.com/EdOverflow/can-i-take-over-xyz/pull/20) | |
| Tumblr | 边界情况 | 🟥 | | `Whatever you were looking for doesn't currently exist at this address` | [Issue #240](https://github.com/EdOverflow/can-i-take-over-xyz/issues/240) | [Tumblr 自定义域名](https://www.tumblr.com/docs/en/custom_domains) |
| Uberflip | 存在漏洞 | 🟩 | read.uberflip.com | `The URL you've accessed does not provide a hub.` | [Issue #150](https://github.com/EdOverflow/can-i-take-over-xyz/issues/150) | [Uberflip 文档](https://help.uberflip.com/hc/en-us/articles/360018786372-Custom-Domain-Set-up-Your-Hub-on-a-Subdomain) |
| Unbounce | 无漏洞 | 🟥 | | `The requested URL was not found on this server.` | [Issue #11](https://github.com/EdOverflow/can-i-take-over-xyz/issues/11) | |
| Uptimerobot | 存在漏洞 | 🟥 | stats.uptimerobot.com | `page not found` | [Issue #45](https://github.com/EdOverflow/can-i-take-over-xyz/issues/45) | [Uptimerobot-Sub-takeover](https://exploit.linuxsec.org/uptimerobot-com-custom-domain-subdomain-takeover/) |
| UserVoice | 无漏洞 | 🟥 | | `This UserVoice subdomain is currently available!` | [Issue #163](https://github.com/EdOverflow/can-i-take-over-xyz/issues/163) | |
| Vercel | 边界情况 | 🟥 | https://nonexistent-example.vercel.com/ | `DEPLOYMENT_NOT_FOUND.` | [Issue #183](https://github.com/EdOverflow/can-i-take-over-xyz/issues/183) | [添加和配置自定义域名](https://vercel.com/docs/concepts/projects/domains/add-a-domain) |
| WP Engine | 无漏洞 | 🟥 | | | | |
| Webflow | 边界情况 | 🟥 | | `The page you are looking for doesn't exist or has been moved.` | [Issue #44](https://github.com/EdOverflow/can-i-take-over-xyz/issues/44) | [论坛 webflow](https://forum.webflow.com/t/hosting-a-subdomain-on-webflow/59201) |
| Wix | 边界情况 | 🟥 | | `Looks Like This Domain Isn't Connected To A Website Yet!` | [Issue #231](https://github.com/EdOverflow/can-i-take-over-xyz/issues/231) | |
| Wordpress | 存在漏洞 | 🟩 | wordpress.com | `Do you want to register .*.wordpress.com?` | [PR #176](https://github.com/EdOverflow/can-i-take-over-xyz/pull/176) | |
| Worksites | 存在漏洞 | 🟩 | worksites.net, 69.164.223.206 | `Hello! Sorry, but the website you’re looking for doesn’t exist.` | [Issue #142](https://github.com/EdOverflow/can-i-take-over-xyz/issues/142) | |
| Zendesk | 无漏洞 | 🟥 | | `Help Center Closed` | [Issue #23](https://github.com/EdOverflow/can-i-take-over-xyz/issues/23) | [Zendesk 支持](https://support.zendesk.com/hc/en-us/articles/203664356-Changing-the-address-of-your-Help-Center-subdomain-host-mapping-) |<!--FINGERPRINTS-->