Fastly Restrictions

Question

Fastly Restrictions

riramar opened this issue 6 years ago · comments

Ricardo Iramar dos Santos commented 6 years ago

Fastly will work only in some specific situations. In some cases they validate the customer domain before assign the fastly.net subdomain.

https://docs.fastly.com/guides/securing-communications/managing-domains-on-tls-certificates#verifying-domain-ownership

Verifying domain ownership
Any time you request addition of a domain to a certificate, you must verify you own the domain. This helps us ensure no one else is using your domain without your permission.

Michael Skelton · Answer 1 · Fri Jul 13 2018 01:07:27 GMT+0800 (China Standard Time)

That certainly merits further investigation!

@EdOverflow I'm unable to look at this for a week, what's your capacity like? Happy for you to tag me on this if you're snowed under also.

Related to the work on #20 I think this should be done in a test cases and then added to the main readme.

Jesse Clark · Answer 2 · Mon Jul 16 2018 22:27:43 GMT+0800 (China Standard Time)

Here is the verification screen and types.
DNS, Email, or text file file upload.

tolo7010 · Answer 3 · Mon Oct 29 2018 15:39:40 GMT+0800 (China Standard Time)

Hi @EdOverflow ,

I've been confirmed on my last report that this is not a valid vulnerability. This is the default Fastly error message if you are visiting the sub-domain directly which is not the intended use case, since it is part of a redirect by the CDN.

Regards,
tolo7010

sostoli · Answer 4 · Sun Apr 21 2019 04:34:29 GMT+0800 (China Standard Time)

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

m7mdharoun · Answer 5 · Mon Apr 29 2019 09:49:26 GMT+0800 (China Standard Time)

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

sostoli · Answer 6 · Mon Apr 29 2019 11:12:24 GMT+0800 (China Standard Time)

Hi bro. Is it possible to have the required steps? Le lun. 29 avr. 2019 à 2:49 AM, m7mdharoun <notifications@github.com> a écrit :

…

Hi @EdOverflow <https://github.com/EdOverflow>, Is it still possible to claim subdomain on Fastly? Regards, Yes Bro I do a Takeover last 2 days for a 4 domains. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#22 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AI2PH4Y5F7AVHC7CULVE4N3PSZH2VANCNFSM4FJQJFVQ> .

wh1pl4sh · Answer 7 · Mon May 13 2019 22:18:39 GMT+0800 (China Standard Time)

Can someone post step by step subdomain takeover on fastly?

m7mdharoun · Answer 8 · Tue May 14 2019 01:05:41 GMT+0800 (China Standard Time)

@n1ghtfox its simple and easy ..

create a new service ( ex: version 1) .
add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps.
then in the Origin Host add Your VPS ip without ssl if not include port 80.
Active your service ( version 1 )

if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this
http://domain.com.global.prod.fastly.net and it will show your vps page.
Sure you can wait 10 min to avoid doing this step :)

Kind Regards,
Mohamed Haron.

wh1pl4sh · Answer 9 · Tue May 14 2019 02:38:44 GMT+0800 (China Standard Time)

Thanks, i could never register domain, so i thought there was other way around.

…

On Mon, May 13, 2019 at 9:05 PM m7mdharoun ***@***.***> wrote: @n1ghtfox <https://github.com/n1ghtfox> its simple and easy .. 1. create a new service ( ex: version 1) . 2. add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps. 3. then in the Origin Host add Your VPS ip without ssl if not include port 80. 4. Active your service ( version 1 ) if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this http://domain.com.global.prod.fastly.net and it will show your vps page. Sure you can wait 10 min to avoid doing this step :) Kind Regards, Mohamed Haron. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMUD6WAC4QRATAQTTSLPVGNWVA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVI6KHI#issuecomment-491906333>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMVDGB6D7ZHJE7L2VPDPVGNWVANCNFSM4FJQJFVQ> .

venkatst · Answer 10 · Wed May 22 2019 22:21:51 GMT+0800 (China Standard Time)

@m7mdharoun,

In 2nd point, you have mentioned add subdomain. This is victim subdomain right?
And what if it get rejected. Is there a way to control traffic like redirection?

wh1pl4sh · Answer 11 · Sun Jun 09 2019 21:01:59 GMT+0800 (China Standard Time)

i think i'm up to something can u help me out on fastly?

…

On Wed, May 22, 2019 at 6:21 PM venkatst ***@***.***> wrote: @m7mdharoun <https://github.com/m7mdharoun>, In 2nd point, you have mentioned add subdomain. This is victim subdomain right? And what if it get rejected. Is there a way to control traffic like redirection? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMXHHVPRPIXEXY25HU3PWVJIJA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODV7GX7Q#issuecomment-494824446>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMQCS6SPRG7UBKEEMS3PWVJIJANCNFSM4FJQJFVQ> .

vaadata-thevenota · Answer 12 · Mon Jun 24 2019 18:20:50 GMT+0800 (China Standard Time)

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:

sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx

I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

m7mdharoun · Answer 13 · Mon Jun 24 2019 18:25:57 GMT+0800 (China Standard Time)

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

Joe Bartlett · Answer 14 · Wed Jul 10 2019 02:42:20 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

Aman Rawat · Answer 15 · Thu Jul 11 2019 09:35:22 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.

Yes I also got the same error

Monaim · Answer 16 · Sun Aug 04 2019 08:38:56 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

sumgr0 · Answer 17 · Sun Aug 04 2019 12:20:08 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

No1d3a · Answer 18 · Tue Aug 06 2019 21:36:25 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

The same error, Any updates!?

sumgr0 · Answer 19 · Wed Aug 07 2019 09:07:51 GMT+0800 (China Standard Time)

Just for confirmation of how Fastly is still possible to takeover, check out www.litium.de. This shall confirm the edge scenario.

Aditya Soni · Answer 20 · Mon Oct 14 2019 21:17:29 GMT+0800 (China Standard Time)

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:
Domain 'redacted.com' is already taken by another customer
Definitely an Edge Case.

Yes I also got the same error

me to same error any update ??

Yes, its an edge case.

I was able to takeover a subdomain for a H1 program and was awarded bounty about a week back.

Any Updates got the same error!

Ashhad Ali · Answer 21 · Thu Oct 17 2019 02:48:21 GMT+0800 (China Standard Time)

is it possible that we can take over any vulnerable subdomain using fastly services or not or we use the different services which that domain use?

efkann · Answer 22 · Wed Oct 23 2019 06:55:11 GMT+0800 (China Standard Time)

Hey, just used this method to takeover a subdomain and it worked. But still it's an edge case. In this one, the error was :
"Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala"

Ankush Goel · Answer 23 · Thu Dec 05 2019 15:43:33 GMT+0800 (China Standard Time)

i am getting the same error as above described by mefkan. "Fastly error: unknow domain: domainname.com. Please check that this domain has been added to a service. Details: cache-blalala". but still unable to add domain to fastly

I am getting error - domain "abc" is already taken by another customer. Am i doing something wrong here?

bbbb · Answer 24 · Sun Dec 08 2019 17:17:41 GMT+0800 (China Standard Time)

Any Updates got the same error! I am getting error - domain "abc" is already taken by another customer

sumgr0 · Answer 25 · Sun Dec 08 2019 20:26:37 GMT+0800 (China Standard Time)

This is still an edge case. Got 2 takeovers during this week for the same program, so it’s still vulnerable but not every time.

On Sun, 8 Dec 2019 at 2:47 PM, bbbb ***@***.***> wrote: Any Updates got the same error! I am getting error - domain "abc" is already taken by another customer — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=ACW5BD6L4YPPQPCPGDOWRITQXS3TNA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGGZLCI#issuecomment-562926985>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACW5BD2BCE5KTUTOWNWDLF3QXS3TNANCNFSM4FJQJFVQ> .

-- Best, Sumit Grover

MelarDev · Answer 26 · Sun Dec 08 2019 20:30:48 GMT+0800 (China Standard Time)

@sumgr0 For the same program? They were using two different domains in scope rigth?
At this time fastly is checking the domain(example.com) given, if it is taken once you can't register any of the subdomains (ignorebyfastly.example.com)
So a company is vulnerable only if they stop completly from using fastly for a whole domain.

sumgr0 · Answer 27 · Sun Dec 08 2019 20:32:24 GMT+0800 (China Standard Time)

That’s right 2 different subdomains on the same program were covered by the scope.

…

On 08-Dec-2019, at 6:00 PM, MelarDev ***@***.***> wrote: @sumgr0 <https://github.com/sumgr0> For the same program? They were using two different domains in scope rigth? At this time fastly is checking the domain(example.com) given if it is taken once you can't register any of the subdomains (ignorebyfastly.example.com) So a company is vulnerable only if they stop completly from using fastly for a whole domain. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=ACW5BD2WLAGSWGXZT5ZDMRLQXTSHTA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGG5JJI#issuecomment-562943141>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACW5BDZWKLCV5IOI3MGSXDTQXTSHTANCNFSM4FJQJFVQ>.

MelarDev · Answer 28 · Sun Dec 08 2019 20:39:41 GMT+0800 (China Standard Time)

@sumgr0 so you took over subdomain1.example.com and subdomain2.example.com ? Fastly UI says the opposite than you do, if you try to take subdomain1.example.com Fastly is only checking if example.com is taken, if it is you can't not register subdomain1.example.com nor subdomain2.example.com nor any other subdomain for that example.com, even if one of them is showing the fingerprint error message.

sumgr0 · Answer 29 · Sun Dec 08 2019 20:45:43 GMT+0800 (China Standard Time)

I understand, and confirm it worked for this time and allowed. Also the reason, as mentioned by the program, they were in the process of decommissioning the Fastly service, while I took over the subdomains. I've had mostly the experience of it not working, but once or twice it worked. Maybe due to the way the account is configured by the programs (they may or may not be using wildcards).

Hence, it seems if the setup contains the wildcard entries, it does not allow to takeover any subdomain belonging to the program and gives out the error: domain "abc" is already taken by another customer. And works when they setup individual subdomains on the service.

Hopefully this helps.

MelarDev · Answer 30 · Sun Dec 08 2019 21:14:40 GMT+0800 (China Standard Time)

@sumgr0 Yes, it helps, thanks =)

Arjun sharma · Answer 31 · Mon Dec 09 2019 23:10:42 GMT+0800 (China Standard Time)

another corner case is :-
arjuns-MacBook-Air:domaintakeover arjunsharma$ dig elle.tw

; <<>> DiG 9.10.6 <<>> elle.tw
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42494
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;elle.tw. IN A

;; ANSWER SECTION:
elle.tw. 86400 IN A 151.101.128.200
elle.tw. 86400 IN A 151.101.192.200
elle.tw. 86400 IN A 151.101.0.200
elle.tw. 86400 IN A 151.101.64.200

arjuns-MacBook-Air:domaintakeover arjunsharma$ dig www.elle.tw

; <<>> DiG 9.10.6 <<>> www.elle.tw
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19199
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.elle.tw. IN A

;; ANSWER SECTION:
www.elle.tw. 80835 IN CNAME www.elle.com.tw.
www.elle.com.tw. 60 IN CNAME nonssl.global.fastly.net.
nonssl.global.fastly.net. 30 IN A 151.101.128.204
nonssl.global.fastly.net. 30 IN A 151.101.0.204
nonssl.global.fastly.net. 30 IN A 151.101.64.204
nonssl.global.fastly.net. 30 IN A 151.101.192.204

this kind of misconfigurations is also making services vulnerable

Rushi Gaikwad · Answer 32 · Sat Apr 11 2020 23:55:50 GMT+0800 (China Standard Time)

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?
Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

can you guide us how you did it

Rushi Gaikwad · Answer 33 · Sat Apr 11 2020 23:56:08 GMT+0800 (China Standard Time)

can you guide us how you did it

m7mdharoun · Answer 34 · Sat Apr 11 2020 23:57:37 GMT+0800 (China Standard Time)

here bro https://www.youtube.com/watch?v=9DYEg_j-_hw

Rushi Gaikwad · Answer 35 · Sat Apr 11 2020 23:57:59 GMT+0800 (China Standard Time)

thanks very much

Rushi Gaikwad · Answer 36 · Sun Apr 12 2020 00:05:56 GMT+0800 (China Standard Time)

Great PoC thanks for that I also follow you blog learned subdomain takeover through you blogs

here bro https://www.youtube.com/watch?v=9DYEg_j-_hw

Great PoC thanks for that I also follow you blog learned subdomain takeover through you blogs and I guess the subdomain i was trying to takeover is not vulnerable becoz it says " domain is already took by another customer"

Japuma · Answer 37 · Tue Apr 14 2020 01:25:20 GMT+0800 (China Standard Time)

I'm facing now with this shit Domain 'blahblah.com' is already taken by another customer
Can someone explain me how to fix this shit.

Rushi Gaikwad · Answer 38 · Tue Apr 14 2020 01:59:27 GMT+0800 (China Standard Time)

The 'blahblah.com' is secured and not possible to take over

rishabsinghlogin · Answer 39 · Sat Jul 04 2020 20:44:25 GMT+0800 (China Standard Time)

Is it still possible to claim subdomain on Fastly?

faeeq · Answer 40 · Sun Jul 12 2020 04:55:11 GMT+0800 (China Standard Time)

I successfully claimed a domain
But the link it is generating is
Domain.com.fastly.net
It should show only domain.com
Or domain.com.fastly.net is also correct?

Bhargava-krishna · Answer 41 · Thu Jul 23 2020 12:08:33 GMT+0800 (China Standard Time)

@sumgr0 so you took over subdomain1.example.com and subdomain2.example.com ? Fastly UI says the opposite than you do, if you try to take subdomain1.example.com Fastly is only checking if example.com is taken, if it is you can't not register subdomain1.example.com nor subdomain2.example.com nor any other subdomain for that example.com, even if one of them is showing the fingerprint error message.

Is there any way to bypass this?

sumgr0 · Answer 42 · Thu Jul 23 2020 12:13:32 GMT+0800 (China Standard Time)

Only if the parent domain is not registered with wildcard entry. I've not seen anymore cases with fastly service takeover.

theunited36 · Answer 43 · Fri Oct 09 2020 12:11:11 GMT+0800 (China Standard Time)

It seems that it is not vulnearble because when we try takeover sub_1.test.com , it says that test.com is already registered.

arunrkamaraj · Answer 44 · Fri Jan 22 2021 13:59:46 GMT+0800 (China Standard Time)

vikrams-MacBook-Air:domaintakeover arjunsharma$ dig https://critik.in/best-lip-balms-in-india/

; <<>> DiG 9.10.6 <<>> https://critik.in/best-lip-balms-in-india/
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19199
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;

https://critik.in/best-lip-balms-in-india/ IN A

;; ANSWER SECTION:

https://critik.in/best-lip-balms-in-india/ 80835 IN CNAME https://critik.in/best-lip-balms-in-india/
https://critik.in/best-lip-balms-in-india/ 60 IN CNAME nonssl.global.fastly.net.
nonssl.global.fastly.net. 30 IN A 151.101.128.204
nonssl.global.fastly.net. 30 IN A 151.101.0.204
nonssl.global.fastly.net. 30 IN A 151.101.64.204
nonssl.global.fastly.net. 30 IN A 151.101.192.204

this kind of misconfigurations is also making services vulnerable

com0t · Answer 45 · Tue Mar 02 2021 10:22:03 GMT+0800 (China Standard Time)

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:
sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx
I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

hi @vaadataa how can i register map.fastly.net domain?
Thank~

Z3d · Answer 46 · Wed Mar 03 2021 08:22:37 GMT+0800 (China Standard Time)

can yu tell me how because this is not workin for me

lnlinh31 · Answer 47 · Sun Mar 21 2021 18:29:45 GMT+0800 (China Standard Time)

@vaadataa how can i register map.fastly.net domain? Now i only get a *.global.prod.fastly.net domain

Philippe Delteil · Answer 48 · Thu Jun 03 2021 11:31:09 GMT+0800 (China Standard Time)

After testing many domains with the error page. I haven't found a way to take over the subdomains.

I think this has been fixed and not properly reported here.

Captain0X · Answer 49 · Wed Jul 14 2021 14:51:45 GMT+0800 (China Standard Time)

who knows why i can't takeover this subdomain , is very sad~

No Name · Answer 50 · Wed Dec 15 2021 16:52:24 GMT+0800 (China Standard Time)

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says
Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

Create new delivery service
Name test-example.s3.amazonaws.com
Host is my VPS

Worked

Captain0X · Answer 51 · Wed Dec 15 2021 16:52:43 GMT+0800 (China Standard Time)

<p title=” </noscript> <style onload= alert(document.domain)//"> *{/*all*/color/*all*/:/*all*/#f78fb3/*all*/;} </style> .qmbox .qmbox .qmbox *{color:#f78fb3;}

Nitczi · Answer 52 · Sun Dec 26 2021 21:51:40 GMT+0800 (China Standard Time)

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message:
Domain 'blahblah.com' is already taken by another customer

m7mdharoun · Answer 53 · Mon Dec 27 2021 06:27:24 GMT+0800 (China Standard Time)

Any updates? I've found a error page on a program Bug Bounty but when i going to create, it returns the message: Domain 'blahblah.com' is already taken by another customer

This mean blahblah.com Not Vulnerable to takeover.

Umair Farooqui · Answer 54 · Tue Mar 08 2022 07:23:08 GMT+0800 (China Standard Time)

Is there no way to bypass these errors..?

Domain 'socialcodia.facebook.com' is already taken by another customer.

Captain0X · Answer 55 · Tue Mar 08 2022 12:03:25 GMT+0800 (China Standard Time)

this domain seems has register buy others ------------------ 原始邮件 ------------------ 发件人: "EdOverflow/can-i-take-over-xyz" ***@***.***>; 发送时间: 2022年3月8日(星期二) 上午7:23 ***@***.***>; ***@***.******@***.***>; 主题: Re: [EdOverflow/can-i-take-over-xyz] Fastly Restrictions (#22) Is there no way to bypass these errors..? Domain 'socialcodia.facebook.com' is already taken by another customer. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you commented.Message ID: ***@***.***>

M.Fares · Answer 56 · Mon Mar 28 2022 21:41:34 GMT+0800 (China Standard Time)

Just made a takeover.

Target was test.target.com. CNAME to global.prod.fastly.net

When i open URL, it says Fastly error: unknow domain: test-example.s3.amazonaws.com. Please check that this domain has been added to a service. Details: cache-blalala

Create new delivery service

Name test-example.s3.amazonaws.com

Host is my VPS

Worked

I got the same page in www-TARGET-com.TARGET.com

BUT I didn't understand your tips and I don't know where (Create new delivery service) and the other tips
can you please explain it more deeper
my Twitter:_2os5

Captain0X · Answer 57 · Mon Mar 28 2022 21:41:55 GMT+0800 (China Standard Time)

<p title=” </noscript> <style onload= alert(document.domain)//"> *{/*all*/color/*all*/:/*all*/#f78fb3/*all*/;} </style> .qmbox .qmbox .qmbox *{color:#f78fb3;}

MadMaxx · Answer 58 · Sat Jun 18 2022 20:33:50 GMT+0800 (China Standard Time)

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net
Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

m7mdharoun · Answer 59 · Sun Jun 19 2022 03:12:16 GMT+0800 (China Standard Time)

Is it still possible to takeover CNAME pointing to map.fastly.net? Eg : target.com --> target.com.map.fastly.net Please provide steps if possible. I am getting only target.com.global.prod.fastly.net

No you can only add domain and Fastly choose the name for your domain.

Even you able to takeover target.com.map.fastly.net Services won't Run until you add Domain

Sawrav Chowdhury · Answer 60 · Sat Aug 20 2022 04:27:46 GMT+0800 (China Standard Time)

I think Fastly is no more vulnerable for subdomain takeover .

Filip Jelić · Answer 61 · Mon Sep 05 2022 18:42:21 GMT+0800 (China Standard Time)

@sawravchy I think this is still an edge case - as described by @mohamed-faris , his example still works:

Sawrav Chowdhury · Answer 62 · Mon Sep 05 2022 21:13:01 GMT+0800 (China Standard Time)

Ok got it. Thanks for clarifying this.

vasu4518 · Answer 63 · Fri Oct 07 2022 16:42:36 GMT+0800 (China Standard Time)

fastly error for somthing.target.com is not vulnerable
But somthing.target.in was is vulnerable. can i report

subhash4x · Answer 64 · Mon Oct 31 2022 17:27:20 GMT+0800 (China Standard Time)

hi @m7mdharoun , i used subjack tool and find 5 domain which are showing FASTLY . can vulnerable

deep_sharma · Answer 65 · Thu Nov 24 2022 13:18:48 GMT+0800 (China Standard Time)

Hii @m7mdharoun my custom domain is saved but i get this " Domain does not resolve to the GitHub Pages server" pls help me

Nayeem Islam · Answer 66 · Wed Nov 15 2023 20:22:49 GMT+0800 (China Standard Time)

Just made a takeover. Thank you mate @mohamed-faris

Philippe Delteil · Answer 67 · Thu Jan 18 2024 12:51:12 GMT+0800 (China Standard Time)

I just tried with 600 domains giving the fingerprint, none of them resulted in a takeover.

Fastly Restrictions

;; ANSWER SECTION: elle.tw. 86400 IN A 151.101.128.200 elle.tw. 86400 IN A 151.101.192.200 elle.tw. 86400 IN A 151.101.0.200 elle.tw. 86400 IN A 151.101.64.200

;; ANSWER SECTION:
elle.tw. 86400 IN A 151.101.128.200
elle.tw. 86400 IN A 151.101.192.200
elle.tw. 86400 IN A 151.101.0.200
elle.tw. 86400 IN A 151.101.64.200