Hello, everyone, and welcome to this video.
So in this video, I'm going to show you a new resource that we have created and we have given it the
names.
Can I take over all XYZ now before this video
You must have seen about can I take over XYZ which was the Edoverflow repository, which contained
all the fingerprints for subdomain takeover based vulnerabilities.
Now, we identified that particular repository was not updated since two years and there were several
inconsistencies into those fingerprints, into that repository.
So we tried to fix it.
And we have added more awesome fingerprints into this repository to make your subdomain takeover based
hunting more comprehensive and more awesome.
So what is going to take over all X, Y, Z?
So it is a list of fingerprints which are actually updated for your subdomain because and we have classified
this into 2 fingerprints basically, which are old fingerprint and a new fingerprint.
So it contains 75 fingerprints, as I already said.
And the point you should know is, first of all, there are 75 list of cloud based services that we
have added, which is up to date.
Based on that, we are going to do identification of dangling CName records and we are going to use those
lists of fingerprints and identify the status of takeover of any of the domain or subdomain.
So it is the practical time.
And let's see, how can we utilize this new repository?
If I and you can find this, can I take over all X, Y, Z on my GitHub report on Shifa one, two,
three by the name of all subdomains takeover
all right now, when we come over here, if you scroll down, then you can see all entries over
here.
And these are all the entries that we have created.
And they are around more than 75 new entries with the updated cloud service providers.
And if you go back to here and you can see these are some of the old entries which are updated and can
I takeover XYZ?
And as we have already discussed about it, now, just to show you the proof of concept about the inconsistency
that were present in can I takeover XYZ you can come over here and search for Heroku and you can
see into Heroku for the old can I take over X, Y, Z.
I have added an old fingerprint, if you can see over here and the new fingerprint over here.
All right.
So let's see.
The old fingerprint for Heroku and the old fingerprint was no such app.
And we have added a new fingerprint which says there's nothing here at.
And let me show you over here.
And you can see this is a Heroku subdomain or Heroku domain that we have identified from Censys which
have already shown you and here you can see there's nothing here.
That is the message that we are getting into the response.
So through this way, we are also getting those targets which should not be missed and are vulnerable
to Heroku based subdomain.
takeover let me show you one more example.
To make it more clear and more understandable so you can see Shopify and the old case for Shopify was.
If I if I search shopify you can see Edgecase, which means sometimes it is vulnerable
Sometimes it is not vulnerable and sometimes only the security researchers are able to take over the
Shopify subdomains.
And you can see the fingerprint is sorry.
This shop is currently unavailable.
We have modified the fingerprint and the new fingerprint, which has been added, is only one step left.
And let me show you the target, which are vulnerable to Shopify subdomains record.
And we have written over here as a vulnerable instance of Atkiss.
So let me show you over here a life target which is vulnerable to Shopify takeover.
Let's wait for this to complete, and you can see we have got some quick target, so let me go on any
of the target on board 80 just to load the application and let's see if we are able to identify one
of the Shopify supplement.
And you can see what here it's dude dispensary dot com.
All right.
So we have a target which is vulnerable to Shopify takeover.
And the new fingerprint that we have added is only one step left.
Similarly, we have more targets that you can identify from sensors which will be vulnerable to Shopify
subdomain because so like this, we identified what were the previous issues into the repository and
we have tried to fix it with multiple new fingerprints as well as we have added new target as well,
which are evolved recently and are not added to the old repository.
So I hope you find this very, very useful for talking about subdomain take over responsibilities.
And yes, we are going to constantly update this with more and more fingerprints of new and new cloud
service platforms that we identify.
And in case we see if any of the target subdomains or the target cloud service providers are not vulnerable,
we will update the status over here.
Also, we will be updating the new fingerprints in case we identify any new fingerprint while doing
our research.
So I hope this turns out to be very, very helpful for every one of you in identifying of subdomain
takeover based on liabilities.
One last thing.
You can also contribute over here.
If you identify that any of the new fingerprint while doing your research or you are doing subdomains
because you can just submit a new entry over here, or if you find a new cloud service provider that
involves and is vulnerable to subdomain takeovers based on your research, you can add it over here.
You can just add the title and leave the comment and submit other issue.
We will verify that at our end.
And if it is valid, we will add it to the new list of can I take over all X, Y, Z?
So I hope you guys understood.
Thank you.