Exploitation
The most important thing about the bug bounty hunter approach is to confirm that the takeover is possible and to then take evidence of that. There are major impacts derived from the sub-domain takeover; they are as follows:
- Cookies: If the domain
fulatino.commanages a cookie that is valid for that domain, a sub-domain (sub.fulanito.com) can create cookies that are also valid. So, if you create a malicious cookie to exploit an input validation vulnerability or session management error, for example, it will be accepted. - Cross-origin resource sharing: There is protection called same-origin policy, which restricts share resources that do not come from the same domain. However, if you have control of
sub.fulanito.com, you can share resources withwww.fulanito.comand other sub-domains included in*.fulanito.com, which could lead to a Cross-Site Request Forgery (CSRF) attack. - OAuth whitelisting: Oauth is another form of protection developed to share information about sessions between...
