This post is the write-up about subdomain takeover vulnerable service Worksites that I found back in April 2020. Although this is a paid service, It's possible to create a PoC without having to purchase the service.

Worksites.net

​Worksites.net is a web service for building websites for contractors and growing business, which support custom domains feature.

Service Detection

A record should be pointing to static IP address 69.164.223.206

worksites.melbadry9.xyz. 60     IN      A       69.164.223.206

I use the following Nuclei template to check for possible candidates.

id: detect-worksites
​
info:
  name: worksites.net service detection
  author: melbadry9
  severity: info
  tags: dns
​
dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 2
    matchers:
      - type: word
        words:
          - "69.164.223.206"

Takeover Detection

To verify whether subdomain takeover may be possible we should see a similar error page.

Fingerprint

To detect vulnerable subdomain we use the following fingerprint based on HTTP response we confirm whether subdomain is vulnerable or not.

{
    "status_code": 404,
    "text": [
        "Company Not Found",
        "Hello! Sorry, but the website you’re looking for doesn’t exist."
    ]
}

I use the following Nuclei template to check for vulnerable subdomain.

id: worksites-takeover
​
info:
  name: worksites.net subdomain takeover
  author: melbadry9
  severity: high
  tags: takeover
​
requests:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Company Not Found"
          - "Hello! Sorry, but the website you’re looking for doesn’t exist."
        condition: and
      - type: status
        status:
          - 404

Takeover Steps

• Register an account on Worksites.net​

• Go to https://app.worksites.net/website/domain-name

• Set Your domain name to subdomain we want to takeover worksites.melbadry9.xyz

• Visit worksites.melbadry9.xyz

• Create screenshot as PoC, we can publish site for $27.00 per month

Can I takeover XYZ? - Issue

I have opened an issue on GitHub regarding this service:

​