fastly is vuln about can-i-take-over-xyz HOT 3 OPEN

Really cool finding and even cooler sub-takeover page. That being said how is it possible that the main domain is not claimed?

Did you just put in your own subdomain (unrelated to Pandora) and hoped it would work or did that subdomain pop-up during recon as a fastly subdomain?

Edit: I tried testing the above out and I got the following error:

Fastly error: unknown domain: [SubtakeoverPOC.Redacted.com] Please check that this domain has been added to a service

from can-i-take-over-xyz.

Really cool finding and even cooler sub-takeover page. That being said how is it possible that the main domain is not claimed?

Did you just put in your own subdomain (unrelated to Pandora) and hoped it would work or did that subdomain pop-up during recon as a fastly subdomain?

Edit: I tried testing the above out and I got the following error:

Fastly error: unknown domain: [SubtakeoverPOC.Redacted.com] Please check that this domain has been added to a service

• login into your fastly account
• go into CDN services
• create a new service
• go to Service configuration / Domains
• add your vuln subdomain there (SubtakeoverPOC.Redacted.com)

it will work if none already have it added

from can-i-take-over-xyz.

Really cool finding and even cooler sub-takeover page. That being said how is it possible that the main domain is not claimed?

Did you just put in your own subdomain (unrelated to Pandora) and hoped it would work or did that subdomain pop-up during recon as a fastly subdomain?

Edit: I tried testing the above out and I got the following error:

Fastly error: unknown domain: [SubtakeoverPOC.Redacted.com] Please check that this domain has been added to a service

i used subzy to scan many subdomains and it popped as vuln (live.pandora.com [ FASTLY ]) so i did the steps that i sent and worked
ps; the takeover could be false i think when origin is not reached fastly will give same error as not claimed

from can-i-take-over-xyz.