Fastly Restrictions

[riramar]

Fastly will work only in some specific situations. In some cases they validate the customer domain before assign the fastly.net subdomain.

https://docs.fastly.com/guides/securing-communications/managing-domains-on-tls-certificates#verifying-domain-ownership

Verifying domain ownership
Any time you request addition of a domain to a certificate, you must verify you own the domain. This helps us ensure no one else is using your domain without your permission.

[codingo]

That certainly merits further investigation!

@EdOverflow I'm unable to look at this for a week, what's your capacity like? Happy for you to tag me on this if you're snowed under also.

Related to the work on #20 I think this should be done in a test cases and then added to the main readme.

[JesseClarkND]

Here is the verification screen and types.
DNS, Email, or text file file upload.

[tolo7010]

Hi @EdOverflow ,

I've been confirmed on my last report that this is not a valid vulnerability. This is the default Fastly error message if you are visiting the sub-domain directly which is not the intended use case, since it is part of a redirect by the CDN.

Regards,
tolo7010

[sostoli]

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

[m7mdharoun]

Hi @EdOverflow,
Is it still possible to claim subdomain on Fastly?

Regards,

Yes Bro I do a Takeover last 2 days for a 4 domains.

[sostoli]

Hi bro. Is it possible to have the required steps? Le lun. 29 avr. 2019 à 2:49 AM, m7mdharoun <notifications@github.com> a écrit :

…

Hi @EdOverflow <https://github.com/EdOverflow>, Is it still possible to claim subdomain on Fastly? Regards, Yes Bro I do a Takeover last 2 days for a 4 domains. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#22 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AI2PH4Y5F7AVHC7CULVE4N3PSZH2VANCNFSM4FJQJFVQ> .

[n1ghtfox]

Can someone post step by step subdomain takeover on fastly?

[m7mdharoun]

@n1ghtfox its simple and easy ..

1. create a new service ( ex: version 1) .
2. add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps.
3. then in the Origin Host add Your VPS ip without ssl if not include port 80.
4. Active your service ( version 1 )

if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this
http://domain.com.global.prod.fastly.net and it will show your vps page.
Sure you can wait 10 min to avoid doing this step :)

Kind Regards,
Mohamed Haron.

[n1ghtfox]

Thanks, i could never register domain, so i thought there was other way around.

…

On Mon, May 13, 2019 at 9:05 PM m7mdharoun ***@***.***> wrote: @n1ghtfox <https://github.com/n1ghtfox> its simple and easy .. 1. create a new service ( ex: version 1) . 2. add subdomain or domain if accept to add your domain this mean you can takeover it then do the next steps. 3. then in the Origin Host add Your VPS ip without ssl if not include port 80. 4. Active your service ( version 1 ) if you don't want to wait to know if the domain connecting to vps or not .. You can check it directly by goto domains then near to domain name you will see Test Domain which will open a Link like this http://domain.com.global.prod.fastly.net and it will show your vps page. Sure you can wait 10 min to avoid doing this step :) Kind Regards, Mohamed Haron. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMUD6WAC4QRATAQTTSLPVGNWVA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVI6KHI#issuecomment-491906333>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMVDGB6D7ZHJE7L2VPDPVGNWVANCNFSM4FJQJFVQ> .

[venkatst]

@m7mdharoun,

In 2nd point, you have mentioned add subdomain. This is victim subdomain right?
And what if it get rejected. Is there a way to control traffic like redirection?

[n1ghtfox]

i think i'm up to something can u help me out on fastly?

…

On Wed, May 22, 2019 at 6:21 PM venkatst ***@***.***> wrote: @m7mdharoun <https://github.com/m7mdharoun>, In 2nd point, you have mentioned add subdomain. This is victim subdomain right? And what if it get rejected. Is there a way to control traffic like redirection? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#22?email_source=notifications&email_token=AFRWIMXHHVPRPIXEXY25HU3PWVJIJA5CNFSM4FJQJFV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODV7GX7Q#issuecomment-494824446>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRWIMQCS6SPRG7UBKEEMS3PWVJIJANCNFSM4FJQJFVQ> .

[vaadata-thevenota]

I confirm that it is possible to take over a subdomain pointing at Fastly, not sure how much of an edge case it is.

DNS:

sub.staging.target.fr. CNAME target.map.fastly.net.
target.map.fastly.net.	A	151.101.xx.xxx

I was able to take over the subdomain by creating an account and specifying the subdomain in the domain configuration for a service.

[m7mdharoun]

@vaadataa I confirm this too last month I takeover 4 subdomains pointing to Fastly

Steps for takeover here Guys with video you can find it here
https://www.mohamedharon.com/2019/06/can-i-takeover-xyz-steps.html

[Dec0y-jb]

This doesn't work for me. If the tld is already registered - it's not possible. The following error is returned:

Domain 'redacted.com' is already taken by another customer

Definitely an Edge Case.