Adding Pantheon #24

dxxzero · 2018-07-23T23:28:35Z

Hey,

I just wanted to submit another website: Pantheon.

Reference: https://medium.com/@hussain_0x3c/hostile-subdomain-takeover-using-pantheon-ebf4ab813111

codingo · 2018-07-27T01:55:57Z

Just letting you know we're not ignoring this one - just trying to carve out some time to properly test it.

dxxzero · 2018-07-27T05:27:48Z

Sure, take your time. Thanks for the follow up information!

codingo · 2019-04-11T23:09:39Z

Resolved with #83

omaramin17 · 2020-04-22T19:04:27Z

i think it doesn't work anymore

agrawalsmart7 · 2020-05-16T14:33:09Z

Yup agreed with @omaramin17.

aadityao1 · 2020-09-02T00:36:46Z

Hey,

I just wanted to submit another website: Pantheon.

Reference: https://medium.com/@hussain_0x3c/hostile-subdomain-takeover-using-pantheon-ebf4ab813111

Did you find fix for this?

cyberblackhole · 2020-09-05T05:49:43Z

I just tried it and I confirm it is not possible to takeover. Any other update so far?

wae23123wq · 2020-09-09T13:34:38Z

I just tried it and I confirm it is not possible to takeover. Any other update so far?

Is it not possible to takeover on pantheon anymore?

pdelteil · 2020-09-23T19:40:47Z

I just took over many patheon subdomains.

You need to activate your account using a credit card. I used a virtual credit card and it worked for free.

aadityao1 · 2020-09-23T20:42:44Z

pantheon is vulneable

Did many takeover this month

cyberblackhole · 2020-09-24T02:31:17Z

@aadityao1 @pdelteil can you please mention the steps in detail.

pdelteil · 2020-09-24T18:09:33Z

Sure, I will, just need some time.

rockybhai0516 · 2020-11-16T16:45:01Z

@pdelteil update the steps bro

united36 · 2021-01-25T14:38:01Z

Hello,

Any dork for this?

spencer5cent · 2021-02-09T09:17:36Z

Hey, I recently found a page with the Pantheon 404 error. I made an account and paid the $50 dollar signup fee. But when I tried to add the vulnerable subdomain, it gave me a “this domain belongs to another organization.” So I cant say for sure if it’s totally impossible to takeover in all situations, but for me it didn’t work and sadly lost money in the process. Thanks for your work!

pdelteil · 2021-02-10T03:41:27Z

Sure, I will, just need some time.

Here..

https://pdelteil.medium.com/how-i-took-over-several-stanford-subdomains-also-let-me-explain-you-the-pain-to-report-it-d84b08704be8

I used a virtual credit card with no funds to bypass the payment step.

pdelteil · 2021-04-29T06:37:41Z

I can confirm it's possible still to take over Pantheon domains.

Using a virtual credit card I managed to bypass the payment of 50 dollars.

pdelteil · 2021-08-05T02:31:22Z

I can confirm it's possible still to take over Pantheon domains.

Using a virtual credit card I managed to bypass the payment of 50 dollars.

It might not be vulnerable anymore.

;
; ANSWER SECTION:
xx.yy.com. 120 IN	CNAME	xx.yy.com.
zz.yy.com. 120	IN	A	23.185.0.3

Dum7c · 2021-09-10T15:36:03Z

Is there an up-to-date way to get around the $50 payment?

pdelteil · 2021-09-10T17:29:54Z

Reach me over twitter if you need to test a takeover

pdelteil · 2021-10-05T18:13:41Z

I think it's not possible to perform this take over anymore.

pdelteil · 2021-10-06T20:52:37Z

So, this is a edge case. Since some subdomains are vulnerable, while others are not. I don't know the reason.
Just will just need to try if the take over works.

Phoenix1112 · 2021-12-21T18:31:54Z

@pdelteil Although a site using pantheon does not have the word "dev" in its cname, this subdomain adds "dev-" to the beginning when I take over the address. what is the reason of this?

pdelteil · 2021-12-22T05:51:18Z

@pdelteil Although a site using pantheon does not have the word "dev" in its cname, this subdomain adds "dev-" to the beginning when I take over the address. what is the reason of this?

I don't really know, that seems to be new on the site.

niemand-sec · 2021-12-22T19:42:16Z

Is this still possible? I have access to the Basic subscription, however, I'm getting the error:

You cannot add the domain XXXXXX as it belongs to another organization. If you believe you've received this message in error, please contact Pantheon support.

Maybe the company has an enterprise subscription with the domain that causes this error?

pdelteil · 2021-12-24T18:41:34Z

Is this still possible? I have access to the Basic subscription, however, I'm getting the error:
You cannot add the domain XXXXXX as it belongs to another organization. If you believe you've received this message in error, please contact Pantheon support.
Maybe the company has an enterprise subscription with the domain that causes this error?

Hello, I haven't tried lately. If you can't add a specific domain doesn't mean you can't add others.

niemand-sec · 2021-12-29T12:48:19Z

Thanks for the answer @pdelteil , what do you mean with others? Despite of not being able to add vuln.company.com, what would be the purpose of adding not-vuln.company.com. I would really appreciate if you could explain further.

Thanks!

pdelteil · 2021-12-30T16:41:02Z

Thanks for the answer @pdelteil , what do you mean with others? Despite of not being able to add vuln.company.com, what would be the purpose of adding not-vuln.company.com. I would really appreciate if you could explain further.

Thanks!

What I meant is, if one domain is not vulnerable doesn't mean other domains are not vulnerable. You just need to try them all.

pdelteil · 2022-02-27T22:18:59Z

Guys just dont ask this b*tch for help : @pdelteil He will know the vulnersble domain from you , and try to block you for literally no valid reason !

Reach me over twitter if you need to test a takeover

I won't tolerate abusive and rude behavior. I have helped many researchers, almost all of them were respectful and we agreed on the terms of the collaboration.

You insulting me describes very well your character.

abd-4fg · 2022-02-27T22:33:45Z

@pdelteil I regret asking for help from you..
All i needed was to confirm whether the domain can be hosted or not (because i dont have pantheon professional account), of which i didnt get the answer ...Instead you asking for program details .?!

Since you know the domain name now, go ahead report it , i dont care now !

vansh1 · 2022-03-08T14:50:01Z

@pdelteil what's your Twitter i want to get subdomain checked

pdelteil · 2022-03-08T20:16:03Z

@pdelteil what's your Twitter i want to get subdomain checked

Hi, I don't longer have a paid account on Pantheon.

FarjaalAhmad · 2022-07-01T14:38:20Z

anybody did do a recent takeover on pantheon? and have a subscription?

Cvar1984 · 2022-08-01T05:11:50Z

anybody did do a recent takeover on pantheon? and have a subscription?

yes, it still vulnerable

FarjaalAhmad · 2022-08-02T07:48:45Z

anybody did do a recent takeover on pantheon? and have a subscription?

yes, it still vulnerable

do you have a subscription? if yes, please mention your twitter.

Cvar1984 · 2022-08-02T07:52:08Z

anybody did do a recent takeover on pantheon? and have a subscription?

yes, it still vulnerable

do you have a subscription? if yes, please mention your twitter.

yes, i have basic plan i take some of juicy domain out there

FarjaalAhmad · 2022-08-02T09:02:23Z

anybody did do a recent takeover on pantheon? and have a subscription?

yes, it still vulnerable

do you have a subscription? if yes, please mention your twitter.

yes, i have basic plan i take some of juice domain out there

check your Twitter DM. Thanks.

ro-fes · 2023-01-25T08:34:23Z

anybody did do a recent takeover on pantheon?

learnerboy88 · 2023-02-09T07:34:58Z

can someone help me takeover this

pdelteil · 2023-02-09T17:12:56Z

can someone help me takeover this

You can reach me over twitter: philippedelteil

oran0s · 2023-02-20T16:18:46Z

Can someone please help me to takeover a subdomain registered to pantheon,
it's in a bug bounty program, but i don't have money, So I want to get private invites at least to start my journey and I won't get it without finding vulnerabilities, can someone please help me to takeover it ?

krkeeper-bh · 2023-03-09T15:25:15Z

@yozen188 , I have a valid account for TakeOver in pantheon, if you want a collaboration do not hesitate to write to my twitter @lainchxn

Currently I have been able to verify that there are different cases where an internal configuration allows the acquisition and reflection of the STO.

Yahy2 · 2023-03-09T21:54:31Z

@yozen188 , I have a valid account for TakeOver in pantheon, if you want a collaboration do not hesitate to write to my twitter @lainchxn

Currently I have been able to verify that there are different cases where an internal configuration allows the acquisition and reflection of the STO.

is it patched already?

oran0s · 2023-03-09T22:56:24Z

@yozen188 , I have a valid account for TakeOver in pantheon, if you want a collaboration do not hesitate to write to my twitter @lainchxn

Currently I have been able to verify that there are different cases where an internal configuration allows the acquisition and reflection of the STO.

I'm trying to message you but you don't recieve messages, you probably disabled inbox in twitter

krkeeper-bh · 2023-03-15T03:44:07Z

@yozen188 , I have a valid account for TakeOver in pantheon, if you want a collaboration do not hesitate to write to my twitter @lainchxn

Currently I have been able to verify that there are different cases where an internal configuration allows the acquisition and reflection of the STO.

is it patched already?

Currently I have been able to verify that depending on the DNS configuration on the server side, the subdomain belonging to the domain "pantheonsite.io" can be acquired, obtaining as a consequence the primary DNS "blog.redacted.com" with "dev-redacted.pantheonsite.io" .
Sometimes certain servers do not reflect the change due to lack of verification or something I miss :/

@yozen188 , I have a valid account for TakeOver in pantheon, if you want a collaboration do not hesitate to write to my twitter @lainchxn

Currently I have been able to verify that there are different cases where an internal configuration allows the acquisition and reflection of the STO.

I'm trying to message you but you don't recieve messages, you probably disabled inbox in twitter

Sorry for the delay, it's already enabled.

oran0s · 2023-03-16T11:08:12Z

I'm trying to message you but you don't recieve messages, you probably disabled inbox in twitter

Sorry for the delay, it's already enabled.

Still can't message you, You can message me then @Ma3en188

gosusnkr · 2023-06-01T11:49:32Z

Hi There,

After reading this conversation, I want to understand my vulnerability.

I found a pantheon-takeover vulnerability on my target using nuclei. I tried to exploit it by referring blogs, registering a domain (not sandbox), and purchasing a basic plan subscription. However, I received an error You cannot add the domain XXXXXX as it belongs to another organization. If you believe you've received this message in error, please contact Pantheon support when I entered my victim domain in Domains/HTTPS.

I need some guidance on what I might be doing wrong. Should I upgrade to a professional subscription or create a domain in the sandbox with a basic subscription? or does this vulnerability not work anymore?

@pdelteil will you help? Sent you a DM on twitter.

waelahmed-dev · 2023-08-11T18:47:01Z

Reach me over twitter if you need to test a takeover

Hey can you dm me twitter for testing takeover? I can't send a message to you
my twitter id is: waeldevx

hoshigakikisame · 2023-10-14T04:59:38Z

Anyone open for collab? I have case to investigate, but I don't have valid pantheon account to test.
Thanks.

proabiral · 2023-10-14T05:42:39Z

Anyone open for collab? I have case to investigate, but I don't have valid pantheon account to test. Thanks.

@hoshigakikisame dm me on Twitter

hoshigakikisame · 2023-10-14T06:03:23Z

@proabiral I've sent you a dm.

testusername911 · 2024-01-17T08:57:39Z

Looks like Pantheon takeovers are not possible anymore... unless someone finds a "bypass" in the future.

https://status.pantheon.io/incidents/53pq1528p18d

hoshigakikisame · 2024-01-21T16:11:23Z

Yeah, I didn't get any luck either in the last case.

codingo mentioned this issue Jul 27, 2018

Create a list of services that have not been tested yet. #21

Closed

EdOverflow added the vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service. label Sep 9, 2018

Avileox mentioned this issue Mar 17, 2019

Various Updates and Improvements #83

Merged

codingo closed this as completed Apr 11, 2019

Adding Pantheon #24

Adding Pantheon #24

Comments

dxxzero commented Jul 23, 2018

codingo commented Jul 27, 2018

dxxzero commented Jul 27, 2018

codingo commented Apr 11, 2019

omaramin17 commented Apr 22, 2020 • edited Loading

agrawalsmart7 commented May 16, 2020

aadityao1 commented Sep 2, 2020

cyberblackhole commented Sep 5, 2020

wae23123wq commented Sep 9, 2020

pdelteil commented Sep 23, 2020 • edited Loading

aadityao1 commented Sep 23, 2020

cyberblackhole commented Sep 24, 2020

pdelteil commented Sep 24, 2020

rockybhai0516 commented Nov 16, 2020

united36 commented Jan 25, 2021

spencer5cent commented Feb 9, 2021

pdelteil commented Feb 10, 2021

pdelteil commented Apr 29, 2021

pdelteil commented Aug 5, 2021

Dum7c commented Sep 10, 2021

pdelteil commented Sep 10, 2021

pdelteil commented Oct 5, 2021

pdelteil commented Oct 6, 2021

Phoenix1112 commented Dec 21, 2021

pdelteil commented Dec 22, 2021

niemand-sec commented Dec 22, 2021

pdelteil commented Dec 24, 2021

niemand-sec commented Dec 29, 2021

pdelteil commented Dec 30, 2021 • edited Loading

pdelteil commented Feb 27, 2022

abd-4fg commented Feb 27, 2022 • edited Loading

vansh1 commented Mar 8, 2022

pdelteil commented Mar 8, 2022

FarjaalAhmad commented Jul 1, 2022

Cvar1984 commented Aug 1, 2022

FarjaalAhmad commented Aug 2, 2022

Cvar1984 commented Aug 2, 2022 • edited Loading

FarjaalAhmad commented Aug 2, 2022

ro-fes commented Jan 25, 2023

learnerboy88 commented Feb 9, 2023

pdelteil commented Feb 9, 2023

oran0s commented Feb 20, 2023

krkeeper-bh commented Mar 9, 2023

Yahy2 commented Mar 9, 2023

oran0s commented Mar 9, 2023 • edited Loading

krkeeper-bh commented Mar 15, 2023

oran0s commented Mar 16, 2023 • edited Loading

gosusnkr commented Jun 1, 2023 • edited Loading

waelahmed-dev commented Aug 11, 2023

hoshigakikisame commented Oct 14, 2023

proabiral commented Oct 14, 2023

hoshigakikisame commented Oct 14, 2023

testusername911 commented Jan 17, 2024

hoshigakikisame commented Jan 21, 2024

omaramin17 commented Apr 22, 2020 •

edited

Loading

pdelteil commented Sep 23, 2020 •

edited

Loading

pdelteil commented Dec 30, 2021 •

edited

Loading

abd-4fg commented Feb 27, 2022 •

edited

Loading

Cvar1984 commented Aug 2, 2022 •

edited

Loading

oran0s commented Mar 9, 2023 •

edited

Loading

oran0s commented Mar 16, 2023 •

edited

Loading

gosusnkr commented Jun 1, 2023 •

edited

Loading