Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fastly Restrictions #22

Closed
riramar opened this issue Jul 12, 2018 · 71 comments
Closed

Fastly Restrictions #22

riramar opened this issue Jul 12, 2018 · 71 comments
Labels
edge case An edge case was discovered where it is possible to hijack a subdomain on this service.

Comments

@riramar
Copy link

riramar commented Jul 12, 2018

Fastly will work only in some specific situations. In some cases they validate the customer domain before assign the fastly.net subdomain.

https://docs.fastly.com/guides/securing-communications/managing-domains-on-tls-certificates#verifying-domain-ownership

Verifying domain ownership
Any time you request addition of a domain to a certificate, you must verify you own the domain. This helps us ensure no one else is using your domain without your permission.
@codingo
Copy link
Collaborator

codingo commented Jul 12, 2018

That certainly merits further investigation!

@EdOverflow I'm unable to look at this for a week, what's your capacity like? Happy for you to tag me on this if you're snowed under also.

Related to the work on #20 I think this should be done in a test cases and then added to the main readme.

@JesseClarkND
Copy link

Here is the verification screen and types.
DNS, Email, or text file file upload.

fastly

@EdOverflow EdOverflow added the edge case An edge case was discovered where it is possible to hijack a subdomain on this service. label Sep 9, 2018
@tolo7010
Copy link

Hi @EdOverflow ,

I've been confirmed on my last report that this is not a valid vulnerability. This is the default Fastly error message if you are visiting the sub-domain directly which is not the intended use case, since it is part of a redirect by the CDN.

Regards,
tolo7010

@sostoli
Copy link

sostoli commented Apr 20, 2019

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

@m7mdharoun
Copy link

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

@sostoli
Copy link

sostoli commented Apr 29, 2019 via email

@n1ghtfox
Copy link

Can someone post step by step subdomain takeover on fastly?

@m7mdharoun
Copy link

@n1ghtfox its simple and easy ..

  1. create a new service ( ex: version 1) .
  2. add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps.
  3. then in the Origin Host add Your VPS ip without ssl if not include port 80.
  4. Active your service ( version 1 )

if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this
http://domain.com.global.prod.fastly.net and it will show your vps page.
Sure you can wait 10 min to avoid doing this step :)

Kind Regards,
Mohamed Haron.

@n1ghtfox
Copy link

n1ghtfox commented May 13, 2019 via email

@venkatst
Copy link

@m7mdharoun,

In 2nd point, you have mentioned add subdomain. This is victim subdomain right?
And what if it get rejected. Is there a way to control traffic like redirection?

@n1ghtfox
Copy link

n1ghtfox commented Jun 9, 2019 via email

@vaadata-thevenota
Copy link

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:

sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx

I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

@m7mdharoun
Copy link

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

@Dec0y-jb
Copy link

Dec0y-jb commented Jul 9, 2019

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

@theamanrawat
Copy link

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

Yes I also got the same error

@mouanime04
Copy link

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

@sumgr0
Copy link

sumgr0 commented Aug 4, 2019

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

@No1d3a
Copy link

No1d3a commented Aug 6, 2019

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

The same error, Any updates!?

@sumgr0
Copy link

sumgr0 commented Aug 7, 2019

Just for confirmation of how Fastly is still possible to takeover, check out www.litium.de. This shall confirm the edge scenario.

@codingo codingo closed this as completed Aug 7, 2019
@hetroublehacker
Copy link

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

Any Updates got the same error!

@ashhadali10
Copy link

is it possible that we can take over any vulnerable subdomain using fastly services or not or we use the different services which that domain use?

@efkann
Copy link

efkann commented Oct 22, 2019

Hey, just used this method to takeover a subdomain and it worked. But still it's an edge case. In this one, the error was :
"Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala"

@ankushgoel27
Copy link

i am getting the same error as above described by mefkan. "Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala". but still unable to add domain to fastly

I am getting error - domain "abc" is already taken by another customer. Am i doing something wrong here?

@jojojump
Copy link

jojojump commented Dec 8, 2019

Any Updates got the same error! I am getting error - domain "abc" is already taken by another customer

@sumgr0
Copy link

sumgr0 commented Dec 8, 2019 via email

@melardev
Copy link

melardev commented Dec 8, 2019 •
edited
Loading

@sumgr0 For the same program? They were using two different domains in scope rigth?
At this time fastly is checking the domain(example.com) given, if it is taken once you can't register any of the subdomains (ignorebyfastly.example.com)
So a company is vulnerable only if they stop completly from using fastly for a whole domain.

@sumgr0
Copy link

sumgr0 commented Dec 8, 2019 via email

@melardev
Copy link

melardev commented Dec 8, 2019

@sumgr0 so you took over subdomain1.example.com and subdomain2.example.com ? Fastly UI says the opposite than you do, if you try to take subdomain1.example.com Fastly is only checking if example.com is taken, if it is you can't not register subdomain1.example.com nor subdomain2.example.com nor any other subdomain for that example.com, even if one of them is showing the fingerprint error message.

@sumgr0
Copy link

sumgr0 commented Jul 23, 2020

Only if the parent domain is not registered with wildcard entry. I've not seen anymore cases with fastly service takeover.

@theunited36
Copy link

It seems that it is not vulnearble because when we try takeover sub_1.test.com , it says that test.com is already registered.

@arunrkamaraj
Copy link

vikrams-MacBook-Air:domaintakeover arjunsharma$ dig https://critik.in/best-lip-balms-in-india/

; <<>> DiG 9.10.6 <<>> https://critik.in/best-lip-balms-in-india/
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19199
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;

https://critik.in/best-lip-balms-in-india/ IN A

;; ANSWER SECTION:

https://critik.in/best-lip-balms-in-india/ 80835 IN CNAME https://critik.in/best-lip-balms-in-india/
https://critik.in/best-lip-balms-in-india/ 60 IN CNAME nonssl.global.fastly.net.
nonssl.global.fastly.net. 30 IN A 151.101.128.204
nonssl.global.fastly.net. 30 IN A 151.101.0.204
nonssl.global.fastly.net. 30 IN A 151.101.64.204
nonssl.global.fastly.net. 30 IN A 151.101.192.204

this kind of misconfigurations is also making services vulnerable

@com0t
Copy link

com0t commented Mar 2, 2021

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:

sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx

I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

hi @vaadataa how can i register map.fastly.net domain?
Thank~

@zkebami
Copy link

zkebami commented Mar 3, 2021

can yu tell me how because this is not workin for me

@lnlinh31
Copy link

@vaadataa how can i register map.fastly.net domain? Now i only get a *.global.prod.fastly.net domain

@pdelteil
Copy link
Contributor

pdelteil commented Jun 3, 2021

After testing many domains with the error page. I haven't found a way to take over the subdomains.

I think this has been fixed and not properly reported here.

@Captain0X
Copy link

image
image
image
who knows why i can't takeover this subdomain , is very sad~

@vionde
Copy link

vionde commented Dec 15, 2021 •
edited
Loading

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says
Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

  1. Create new delivery service
  2. Name test-example.s3.amazonaws.com
  3. Host is my VPS

Worked

@Captain0X
Copy link

Captain0X commented Dec 15, 2021 via email

@unf0rgvn
Copy link

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message:
Domain 'blahblah.com' is already taken by another customer

@m7mdharoun
Copy link

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message: Domain 'blahblah.com' is already taken by another customer

This mean blahblah.com Not Vulnerable to takeover.

@mufazmi
Copy link

mufazmi commented Mar 7, 2022

Is there no way to bypass these errors..?

Domain 'socialcodia.facebook.com' is already taken by another customer.

image

@Captain0X
Copy link

Captain0X commented Mar 8, 2022 via email

@mohamed-faris
Copy link

mohamed-faris commented Mar 28, 2022 •
edited
Loading

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

  1. Create new delivery service
  2. Name test-example.s3.amazonaws.com
  3. Host is my VPS

Worked

I got the same page in www-TARGET-com.TARGET.com

BUT I didn't understand your tips and I don't know where (Create new delivery service) and the other tips
can you please explain it more deeper
my Twitter:_2os5

@Captain0X
Copy link

Captain0X commented Mar 28, 2022 via email

@SandeepkrishnaS
Copy link

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net
Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

@m7mdharoun
Copy link

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

No you can only add domain and Fastly choose the name for your domain.

Even you able to takeover target.com.map.fastly.net Services won't Run until you add Domain

@sawravchy
Copy link
Contributor

I think Fastly is no more vulnerable for subdomain takeover .

@gister9000
Copy link

@sawravchy I think this is still an edge case - as described by @mohamed-faris , his example still works:
image

@sawravchy
Copy link
Contributor

Ok got it. Thanks for clarifying this.

@vasu4518
Copy link

vasu4518 commented Oct 7, 2022

fastly error for somthing.target.com is not vulnerable
But somthing.target.in was is vulnerable. can i report

@subhash4x
Copy link

hi @m7mdharoun , i used subjack tool and find 5 domain which are showing FASTLY . can vulnerable

@deepsharma00
Copy link

Hii @m7mdharoun my custom domain is saved but i get this " Domain does not resolve to the GitHub Pages server" pls help me

@nayeems3c
Copy link

Just made a takeover. Thank you mate @mohamed-faris

@pdelteil
Copy link
Contributor

I just tried with 600 domains giving the fingerprint, none of them resulted in a takeover.

@the-air-cyborg
Copy link

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

the link is not working!!

@KKonaNN
Copy link

KKonaNN commented Jun 14, 2024

fastly is an edge case its still vuln when none claimed domain tested on a live target
http://live.pandora.com

@sn1p3rt3s7
Copy link

In my case, when I visited the site redacted.com, I got error
Fastly error: unknown domain: redacted.global.ssl.fastly.net. Please check blah blah blah.
Gone to Fastly.com -> CDN -> CDN services -> New service -> Domain: redacted.global.ssl.fastly.net.
It allowed me to add this as domain so I took over the domain.

@JFOZ1010
Copy link

JFOZ1010 commented Jan 4, 2025

what you say is false, fastly has a protection that prevents users from taking control of subdomains that belong to domains already registered in its infrastructure, and when you try to add the subdomain to take control gives the following error: “{”detail“: ‘Name ’prod.pinterest.global.map.fastly.net' is a reserved public suffix: Domain not valid”}” to keep it in mind, something says Not Vulnerable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
edge case An edge case was discovered where it is possible to hijack a subdomain on this service.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests