Microsoft subdomain takeover

#1

Post by kailanb » Sun, Jan 08, 2023, 12:16 AM UTC

Microsoft subdomain takeover
cseo-coherence.microsoft.com

Re: Microsoft subdomain takeover

#2

Post by metadat » Sun, Jan 08, 2023, 2:48 AM UTC

Is this an example of the attack in the wild? Or what did I just view?

Re: Microsoft subdomain takeover

#3

Post by metadat » Sun, Jan 08, 2023, 5:11 AM UTC

metadat wrote: post #2

Is this an example of the attack in the wild? Or what did I just view?

p.s. archive snapshot in case the site gets taken down later: https://archive.today/DEzVW

Re: Microsoft subdomain takeover

#4

Post by demarq » Sun, Jan 08, 2023, 9:45 PM UTC

I want to click the red button.

so bad.

Re: Microsoft subdomain takeover

#5

Post by _s » Sun, Jan 08, 2023, 9:46 PM UTC

metadat wrote: post #2

Is this an example of the attack in the wild? Or what did I just view?

Someone has added http://cseo-coherence.microsoft.com to their CNAME file on Github Pages, as this domain's DNS entries were already pointing to GitHub Pages.

It's a subdomain takeover, but not as we would normally think of it (getting access to the DNS settings and pointing them to what we want) but from getting "access" to the server the subdomain already points to.