Hello, everyone, and welcome to this video.
In this video, we are going to see subdomain take-over on Tumblr.
Many of us use Tumblr for seeing some of the awesome graphic content or pictures or images, but we
do not know that Tumblr also provides custom.
URL or domains and there are many organizations who point their subdomains to the Tumblr, but
forget to claim them.
Now, here it becomes very, very important for security researchers and bug bounty hunters wherein
they can claim those unclaimed subdomains which are being pointed to Tumblr and show a successful demonstration
of subdomains take over.
All right.
So let's quickly see how can we do this into the practical time.
So for that, what I'm going to do is on to my terminal.
I'm going to fire up the command, which is find domain to get the domain names for the target, which
is srsecure.xyz and hit enter.
Let's wait for this to give me the results.
I'm expecting those results to come really, really quick.
And after we have got those results from that, we are going to identify some of the subdomains to be
vulnerable.
As you can see, we have got the 47 subdomains in mere nine seconds.
And if you have a close look at the subdomains from here, I'm going to choose one of the subdomain,
which is, let's say from this, we are going to choose a subdomain, which is.
Tumblr.srsecure.xyz
So let me see if it has been crawled or not, because I have recently created a subdomain which is
tumblr.srsecure.xyz
Now, when I create subdomains, it may take some time for the DNS crawlers or these crawlers like Google
or Virus Total or Sublister or Facebook or CERT transparency logs of cert.sh to crawl them.
So it may take some time to reflect over here, but to show the proof of concept, I have created a
vulneranleble subdomain which is tumblr.srsecure.xyz
Now if I try to ping this, let us see if this will work or not.
So I'm just going to ping this.
And hit enter and you can see I'm getting a reply, which means the domain is active and it is not a
dead subdomain.
All right.
So let's quickly do a whois and see from where are we getting the reply from.
So we are getting a reply from this particular domain, which is the organization name is given as automattoque.
All right.
So we are getting the reply from this particular organization.
Now, Tumbler may have hosted of its own of the domain from these IP ranges.
That's what we are getting a reply of from this particular organization name.
All right.
So let's quickly see if what we get when we open this IP over here and you can see it is Tumbler.
All right.
We were correct.
And it is redirecting to Tumblr, as you can see, it automatically redirected.
Let me again type it over here and you can see it will again automatically redirect itself.
As you can see, it is redirecting back to Tumblr all through this, we can confirm the IP belongs to
Tumblr.
All right.
Now, what about the subdomain that we have got?
So let me copy paste this into the browser and let's see what happens.
So I'm going to paste this and you can see we got an error, which is there's nothing here.
All right, and it got redirected back to the main domain.
Let me show it once again tumblr.srsecure.xyz and it will redirect back to the main
domain because there is no domain or nothing over here.
Let me just close this, close this and close this.
Now, as we have identified, the vulnerable subdomain and the fingerprint for this particular tumblr
takeover is there's nothing here.
This is the fingerprint where it says there's nothing here for doesn't whatever you're looking for doesn't
exist over here.
All right.
So now we have identified and we have completed our step number one.
Now, the step number two is to take over the successful subdomain and perform a subdomain takeover.
For that, you just need to create an account.
So I have already created an account.
So let me show you over here as I have logged in, as you can see, I'm logged in over here now.
You just need to click on your username once you click on this username.
As you can see, I have created a node as well, which is PoC of Subdomain Take-Over.
Let me go back to my profile, click it over here and click.
Over here and let me go to settings now.
In the settings you can see, these are the settings of e-mail, password and other settings.
Let me click onto the e-mail setting.
It's not over here, let me click again in the blogs.
Yeah, so it is in the blogs.
When you click on blogs, you will be able to see the blog name over here.
You can see the user name under the user name.
You can see a custom domain.
Now it is asking for a custom domain.
And let's try to put our custom domain so.
Let's say this is our custom domain https:// and click on Testament's.
If you get a message, which is it's good, then it is working perfectly fine.
If we get a message that something is wrong, then it is not working fine.
So let me add Apple dot com over here to show you if what is the wrong message that you get or the false
message for domains which are not which are not pointed to Tumblr.
As you can see, the subdomains name is not pointing to Tumblr, but is the message that you are going
to get in case you have got a false domain, which is not pointed to Tumblr
OK, now let's get back to srsecure and let again click on Test domain and we have got a message.
It says, it's good.
Let me save this once I have saved this.
Now the attacker is successfully able to get this particular Tumblr URL.
So let me just go over here and you can see this is the PoC of subdomain take-over.
Perfect.
Now, we are able to take this particular subdomain successfully and we can post any malicious content
that we want over here because we have the full control of that particular subdomain.
Now, if the original owner wants the subdomain, then we need to delete it from here and we need to
turn this off.
And through this, our subdomain will get disabled and the original program owner can claim it back.
Remember, you have to do this step after and after only when they have identified the vulnerability
and they are providing you a reward, bounty or swag, anything that sort of and you have discussed
with the program owner.
And they want to mitigate this issue in case they want to continue using this subdomain.
You have to delete it from here or basically disable from here.
Or if they do not want this particular subdomain, then they can just directly delete the entry from
their DNS.
All right.
So I hope you guys understood how you can do the subdomain take-over for Tumblr.
Thank you.