jake/jarv.is
1
Fork 0
mirror of https://github.com/jakejarvis/jarv.is.git synced 2026-08-10 21:15:21 -04:00
Code Issues Activity

new <Figure> component for image captions

Browse Source
This commit is contained in:
jake
2022-01-13 13:39:22 -05:00
parent 1a0541776e
commit 64a91d67bf
21 changed files with 226 additions and 409 deletions
Download Patch File Download Diff File Expand all files Collapse all files
notes/finding-candidates-subdomain-takeovers.mdx
+10 -19
View File
@@ -11,30 +11,21 @@ tags:
image: "/static/images/notes/finding-candidates-subdomain-takeovers/hackerone-2.png"
---
import Image from "./components/media/Image";
import Figure from "./components/media/Figure";
A **subdomain takeover** occurs when a subdomain (like _example_.jarv.is) points to a shared hosting account that is abandoned by its owner, leaving the endpoint available to claim for yourself.
Not only are takeovers a fun way to dip your toes into [penetration testing](https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/), but they can also be incredibly lucrative thanks to [bug bounty programs](https://en.wikipedia.org/wiki/Bug_bounty_program) on services like [HackerOne](https://hackerone.com/hacktivity?order_direction=DESC&order_field=popular&filter=type%3Aall&querystring=subdomain%20takeover) and [Bugcrowd](https://bugcrowd.com/programs), where corporations pay pentesters for their discoveries.
<figure>
<Image
src="/static/images/notes/finding-candidates-subdomain-takeovers/hackerone-2.png"
width="620"
height="347"
alt="Huge rewards for subdomain takeovers on HackerOne."
priority
/>
<figcaption>
<a
href="https://hackerone.com/hacktivity?querystring=subdomain%20takeover"
target="_blank"
rel="noopener noreferrer"
>
Huge rewards for subdomain takeovers on HackerOne!
</a>
</figcaption>
</figure>
<Figure
src="/static/images/notes/finding-candidates-subdomain-takeovers/hackerone-2.png"
width="620"
height="347"
priority
>
[Huge rewards for subdomain takeovers on
HackerOne!](https://hackerone.com/hacktivity?querystring=subdomain%20takeover)
</Figure>
For a deep dive on the implications of takeovers, which can be a pretty serious vector of attack for malicious actors to obtain information from users of the targeted company, [Patrik Hudak](https://twitter.com/0xpatrik) wrote a [great post here](https://0xpatrik.com/subdomain-takeover/). Definitely take some time to skim through it and come back here when you're ready to hunt for a potential takeover yourself.