Information Gathering
- Subdomain Finder c99
- Subdomain Lister Venkon
- Spyse
- Wayback machine
- Netcraft
- Robtex
- Whois
- Reverse IP
- Built With
- DNS Dumpster
- CRT.sh
- Reverse IP
- Dig-DNS lookup
Bug Bounty Dorks to find a program
inurl /bug bounty
inurl : / security
inurl:security.txt
inurl:security "reward"
inurl : /responsible disclosure
inurl : /responsible-disclosure/ reward
inurl : / responsible-disclosure/ swag
inurl : / responsible-disclosure/ bounty
inurl:'/responsible disclosure' hoodie
responsible disclosure swag r=h:com
responsible disclosure hall of fame
responsible disclosure europe
responsible disclosure white hat
white hat program
insite:"responsible disclosure" -inurl:nl
intext responsible disclosure
site eu responsible disclosure
site .nl responsible disclosure
site responsible disclosure
responsible disclosure:sites
responsible disclosure r=h:nl
responsible disclosure r=h:uk
responsible disclosure r=h:eu
responsible disclosure bounty r=h:nl
responsible disclosure bounty r=h:uk
responsible disclosure bounty r=h:eu
responsible disclosure swag r=h:nl
responsible disclosure swag r=h:uk
responsible disclosure swag r=h:eu
responsible disclosure reward r=h:nl
responsible disclosure reward r=h:uk
responsible disclosure reward r=h:eu
"powered by bugcrowd" -site:bugcrowd.com
"powered by hackerone" "submit vulnerability report"
"submit vulnerability report"
site:responsibledisclosure.com
inurl:'vulnerability-disclosure-policy' reward
intext:Vulnerability Disclosure site:nl
intext:Vulnerability Disclosure site:eu
site:..nl intext:security report reward
site:..nl intext:responsible disclosure reward
"security vulnerability" "report"
inurl"security report"
"responsible disclosure" university
inurl:/responsible-disclosure/ university
buy bitcoins "bug bounty"
inurl:/security ext:txt "contact"
"powered by synack"
intext:responsible disclosure bounty
inurl: private bugbountyprogram
inurl:/.well-known/security ext:txt
inurl:/.well-known/security ext:txt intext:hackerone
inurl:/.well-known/security ext:txt -hackerone -bugcrowd -synack -openbugbounty
inurl:reporting-security-issues
inurl:security-policy.txt ext:txt
site:..* inurl:bug inurl:bounty
site:help.. inurl:bounty
site:support.. intext:security report reward
intext:security report monetary inurl:security
intext:security report reward inurl:report
site:security.. inurl: bounty
site:..de inurl:bug inurl:bounty
site:..uk intext:security report reward
site:..cn intext:security report reward
"vulnerability reporting policy"
"van de melding met een minimum van een" -site:responsibledisclosure.nl
inurl : /bitcon bug bounty
inurl : btc security rewards
Resourceful Blogs
- HACTIVITY
- CROWDSTREAM
- DAILY-SWIG
- EDOVERFLOW
- ALLYSONOMALLEY
- PHILPPEHAREWOOD
- NGAILONG
- SHUBS
- SAMCURRY
- BUER
Vulnerabilites DB
Exploits DB
IP Lookup
Tools
- KALI TOOLS
- INSECURE
- HACKERES ONLINE CLUB
- CONCISE COURSES
- DARKNET
- KITPLOIT
- TOOLSWATCH
- ROMHACKING
- BLACK ARCH
Hacking labs
Encrpyt/Decrypt
Hash Crackers
Network Online tools
SUBDOMAIN - CAN-I-TAKE-ALL-OVER-XYZ
Disclaimer :warning:
The authors of this document take no responsibility for correctness. This project is merely here to help guide security researchers towards determining whether something is vulnerable or not, but does not guarantee accuracy. This project heavily relies on contributions from the public; therefore, proving that something is vulnerable is the security researcher and bug bounty program's sole discretion. On top of that, it is worth noting that some bug bounty programs may accept dangling DNS record reports without requiring proof of compromise.
What is a subdomain takeover?
Subdomain takeover vulnerabilities occur when a subdomain (subdomain.example.com) is pointing to a service (e.g. GitHub pages, Heroku, etc.) that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain. For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com.
You can read up more about subdomain takeovers here:
- https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/
- https://www.hackerone.com/blog/Guide-Subdomain-Takeovers
- https://0xpatrik.com/subdomain-takeover-ns/
Safely demonstrating a subdomain takeover
Based on personal experience, claiming the subdomain discreetly and serving a harmless file on a hidden page is usually enough to demonstrate the security vulnerability. Do not serve content on the index page. A good proof of concept could consist of an HTML comment served via a random path:
$ cat index.html
<!-- PoC by Hacker -->
Please be advised that this depends on what bug bounty program you are targeting. When in doubt, please refer to the bug bounty program's security policy and/or request clarifications from the team behind the program.
How to use this project
I recommend searching for the name of the service you are targeting in the issues tab. That way you can see the on-going discussion and more detailed steps on how to claim the subdomain you are after.
How to contribute
You can submit new services here: https://github.com/shifa123/ALLsubdomaintakeovers/issues/new?template=new-entry.md
All entries
| Engine | Status | Old Fingerprint | New Fingerprint | Documentation |
|---|---|---|---|---|
| Acquia | Not vulnerable | Web Site Not Found | If you are an Acquia Cloud customer and expect to see your site at this address `` | Issue #103 |
| Aftership | Vulnerable | Oops.</h2><p class="text-muted text-tight">The page you're looking for doesn't exist. | ||
| Agile CRM | Vulnerable | Sorry, this page is no longer available. | Sorry, this page is no longer available | |
| Aha | Vulnerable | There is no portal here ... sending you back to Aha! | ||
| Airee.ru | Vulnerable | Ошибка 402. Сервис Айри.рф не оплачен | ||
| Anima | Vulnerable | If this is your website and you've just created it, try refreshing in a minute | If this is your website and you've just created it, try refreshing in a minute | |
| Akamai | Not vulnerable | Not Vulnerable | ||
| AWS/S3 | Vulnerable | The specified bucket does not exist | The specified bucket does not exist | |
| Bigcartel | Vulnerable | <h1>Oops! We couldn’t find that page.</h1> | ||
| Bitbucket | Vulnerable | Repository not found | The page you have requested does not exist | |
| Brightcove | Vulnerable | <p class="bc-gallery-error-code">Error Code: 404</p> | ||
| Campaign Monitor | Vulnerable | Trying to access your account? | <strong>Trying to access your account?</strong> | |
| Canny | Vulnerable | Trying to access your account? | Company Not Found | |
| Cargo | Vulnerable | If you're moving your domain away from Cargo you must make this configuration through your registrar's DNS control panel. | ||
| Cargo Collective | Vulnerable | 404 Not Found | <div class="notfound"> | |
| Cloudfront | Not vulnerable | ViewerCertificateException | ||
| Desk | Vulnerable | Please try again or try Desk.com free for 14 days. | this help center no longer exists | |
| Digital Ocean | Vulnerable | Domain uses DO name serves with no records in DO. | ||
| Discourse | Vulnerable | |||
| Fastly | Edge case | Fastly error: unknown domain: | Fastly error: unknown domain: | |
| Feedpress | Not vulnerable | The feed has not been found. | The feed has not been found. | |
| Firebase | Not Vulnerable | |||
| Fly.io | Vulnerable | 404 Not Found | ||
| Freshdesk | Not vulnerable | |||
| Frontify | Vulnerable | 404 - Page Not Found | Oops… looks like you got lost | |
| Gemfury | Vulnerable | 404: This page could not be found. | 404: This page could not be found. | |
| Ghost | vulnerable | The thing you were looking for is no longer here, or never was | The thing you were looking for is no longer here | |
| Github | vulnerable | There isn't a Github Pages site here. | There isn't a GitHub Pages site here. | |
| Gitlab | Not Vulnerable | |||
| Google Cloud Storage | Vulnerable | NoSuchBucket The specified bucket does not exist. | ||
| Getresponse | vulnerable | With GetResponse Landing Pages, lead generation has never been easier | With GetResponse Landing Pages, lead generation has never been easier | |
| HatenaBlog | Vulnerable | 404 Blog is not found | 404 Blog is not found | |
| Help Juice | vulnerable | We could not find what you're looking for. | We could not find what you're looking for. | |
| Help Scout | Vulnerable | No settings were found for this company: | No settings were found for this company: | |
| Heroku | Edge case | No such app | There's nothing here, yet. | |
| Helprace | Vulnerable | Alias not configured! | ||
| Hubspot | vulnerable | Domain not found | ||
| Instapage | Non Vulnerable | |||
| Intercom | vulnerable | Uh oh. That page doesn't exist. | This page is reserved for artistic dogs. | |
| JetBrains | Vulnerable | is not a registered InCloud YouTrack | is not a registered InCloud YouTrack. | |
| Jazzhr | Vulnerable | This account no longer active | ||
| Key CDN | Not vulnerable | |||
| Kinsta | Vulnerable | No Site For Domain | No Site For Domain | |
| LaunchRock | vulnerable | It looks like you may have taken a wrong turn somewhere. Don't worry...it happens to all of us. | It looks like you may have taken a wrong turn somewhere. Don't worry...it happens to all of us. | |
| Landingi | vulnerable | It looks like you're lost | ||
| Mashery | Edge Case | Unrecognized domain | Unrecognized domain <strong> | |
| Microsoft Azure | vulnerable | |||
| Netlify | Edge Case | Not Found | ||
| Ngrok | vulnerable | Tunnel *.ngrok.io not found | ngrok.io not found | |
| Pantheon | Vulnerable | 404 error unknown site! | The gods are wise, but do not know of the site which you seek. | |
| Pingdom | vulnerable | This public report page has not been activated by the user | Public Report Not Activated | |
| Proposify | Vulnerable | If you need immediate assistance, please contact <a href="mailto:support@proposify.biz | ||
| Readme.io | Vulnerable | Project doesnt exist... yet! | Project doesnt exist... yet! | |
| Readthedocs | vulnerable | unknown to Read the Docs | ||
| Sendgrid | Not vulnerable | |||
| Shopify | Vulnerable | Sorry, this shop is currently unavailable. | Only one step left! | |
| SmartJobBoard | vulnerable | This job board website is either expired or its domain name is invalid. | Job Board Is Unavailable | |
| Squarespace | Not Vulnerable | |||
| Statuspage | Not vulnerable | |||
| Strikingly | Vulnerable | page not found | But if you're looking to build your own website | |
| Surge.sh | vulnerable | project not found | project not found | |
| Simplebooklet | vulnerable | We can't find this <a href="https://simplebooklet.com | ||
| Smartling | Vulnerable | Domain is not configured | ||
| Smugmug | vulnerable | {"text":"Page Not Found" | ||
| Surveygizmo | vulnerable | data-html-name | ||
| Tave | Vulnerable | <h1>Error 404: Page Not Found</h1> | ||
| Teamwork | vulnerable | Oops - We didn't find your site. | ||
| Tictail | vulnerable | Building a brand of your own? | ||
| Tumblr | Edge Case | Whatever you were looking for doesn't currently exist at this address | There's nothing here. | |
| Tilda | Edge Case | Please renew your subscription | <title>Please renew your subscription</title> | |
| Uberflip | Vulnerable | Non-hub domain, The URL you've accessed does not provide a hub. | Non-hub domain, The URL you've accessed does not provide a hub. | |
| Unbounce | Edge Case | The requested URL was not found on this server. | The requested URL was not found on this server. | |
| Uptimerobot | Vulnerable | page not found | page not found | |
| UserVoice | vulnerable | This UserVoice subdomain is currently available! | This UserVoice subdomain is currently available! | |
| Vercel | Vulnerable | The deployment could not be found on Vercel. | ||
| Vend | vulnerable | Looks like you've traveled too far into cyberspace. | ||
| Webflow | Edge Case | The page you are looking for doesn't exist or has been moved. | <p class="description">The page you are looking for doesn't exist or has been moved.</p> | |
| Wishpond | Vulnerable | https://www.wishpond.com/404?campaign=true | ||
| Wufoo | vulnerable | Profile not found | ||
| Wordpress | vulnerable | Do you want to register *.wordpress.com? | Do you want to register | |
| Worksites | Vulnerable | Hello! Sorry, but the website you’re looking for doesn’t exist. | `Company Not Found | you’re looking for doesn’t exist` |
| WP Engine | Not vulnerable | |||
| Zendesk | Not vulnerable | Help Center Closed |
Checklist
Others
- BBHT
- Nahamsec resources
- BBHT cheatsheet
- Pentest tools
- SoldierX
- Xmind
- THM
- BBHT
- Portswigger websecurity
- Portswigger labs
- Portswigger xss cheatsheet
- OWASP xss cheatsheet
- list of writeups
- Entysec
- Google havking for xss and openredirect
site:WEBSITE ext:php inurl:?
Disclosed XSS and Open Redirects
site:WEBSITE inurl:reports intext:"WEBSITE"
Juicy Extensions
site:"WEBSITE" ext:log | ext:txt | ext:conf | ext:cnf | ext:ini | ext:env | ext:sh | ext:bak | ext:backup | ext:swp | ext:old | ext:~ | ext:git | ext:svn | ext:htpasswd | ext:htaccess
Code Leaks
site:pastebin.com "ccsuniversity.ac.in"
site:jsfiddle.net "ccsuniversity.ac.in"
site:codebeautify.org "ccsuniversity.ac.in"
site:codepen.io "ccsuniversity.ac.in"
Cloud Storage
site:s3.amazonaws.com "ccsuniversity.ac.in"
site:blob.core.windows.net "ccsuniversity.ac.in"
site:googleapis.com "ccsuniversity.ac.in"
site:drive.google.com "ccsuniversity.ac.in"
site:dev.azure.com "ccsuniversity.ac.in"
site:onedrive.live.com "ccsuniversity.ac.in"
site:digitaloceanspaces.com "ccsuniversity.ac.in"
site:sharepoint.com "ccsuniversity.ac.in"
site:https://lnkd.in/e8YtGqdX "ccsuniversity.ac.in"
site:https://lnkd.in/evKFV7KK "ccsuniversity.ac.in"
site:dropbox.com/s "ccsuniversity.ac.in"
site:box.com/s "ccsuniversity.ac.in"
site:docs.google.com inurl:"/d/" "ccsuniversity.ac.in"
XSS prone parameters
inurl:q= | inurl:s= | inurl:search= | inurl:query= inurl:& site:WEBSITE
Open Redirect prone parameters
inurl:url= | inurl:return= | inurl:next= | inurl:redir= inurl:http site:WEBSITE
SQLi Prone Parameters
inurl:id= | inurl:pid= | inurl:category= | inurl:cat= | inurl:action= | inurl:sid= | inurl:dir= inurl:& site:WEBSITE
SSRF Prone Parameters
inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain= | inurl:page= inurl:& site:WEBSITE
LFI Prone Parameters
inurl:include | inurl:dir | inurl:detail= | inurl:file= | inurl:folder= | inurl:inc= | inurl:locate= | inurl:doc= | inurl:conf= inurl:& site:WEBSITE
RCE Prone Parameters
inurl:cmd | inurl:exec= | inurl:query= | inurl:code= | inurl:do= | inurl:run= | inurl:read= | inurl:ping= inurl:& site:WEBSITE
High % inurl keywords
inurl:config | inurl:env | inurl:setting | inurl:backup | inurl:admin | inurl:php site:WEBSITE
Sensitive Parameters
inurl:email= | inurl:phone= | inurl:password= | inurl:secret= inurl:& site:WEBSITE
JFrog Artifactory
site:jfrog.io "WEBSITE"
Firebase
site:firebaseio.com "WEBSITE"
API Docs
inurl:apidocs | inurl:api-docs | inurl:swagger | inurl:api-explorer site:"WEBSITE"
File upload endpoints
site:WEBSITE ”choose file”
Bug Bounty programs and Vulnerability Disclosure Programs
"submit vulnerability report" | "powered by bugcrowd" | "powered by hackerone"
site:*/security.txt "bounty"
Apache Server Status Exposed
site:*/server-status apache
WordPress
inurl:/wp-admin/admin-ajax.php
Drupal
intext:"Powered by" & intext:Drupal & inurl:user
Joomla
site:*/joomla/login
Tools used by nahamsec
- Amass - Subdomain Generation
- ReconFTW - General Recon
- FFUF - For fuzzing with onelistforall and onemillion wordlist
- MassDNS - DNS Resolver
- Security Trails - Subdomain Enumeartion
- Shodan - UI version for finding hidden gems
- Web Archive - Look for caches
- GitHub - Hidden endpoints, subdomains and secrets
- HTTPX - Filter live endpoints on the subdomains collections
- http://Crt.sh - More info based on certificates
- AlienValut - Massive Recon
- FOFA - Collect favicon hash