[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Subdoamin Takeover Possible via Intercom Help Center #69

Open
MuhammadKhizerJaved opened this issue Nov 20, 2018 · 10 comments
Open

Subdoamin Takeover Possible via Intercom Help Center #69

MuhammadKhizerJaved opened this issue Nov 20, 2018 · 10 comments
Labels
vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service.

Comments

@MuhammadKhizerJaved
Copy link

Intercom Help Center

Proof

If you get an Error Similar to this one that gives 404 Error simply go to https://www.intercom.com/customer-support-software create a new account buy the service or get a free demo for 14 days

Then visit https://app.intercom.io/a/apps/pr1twx7u/articles/site/settings and add the subdomain that's giving error in custom domain field

screenshot 2018-11-20 at 3 40 08 pm

Turn On the Help Center and Publish a test article also otherwise you won't be able to turn on the help center

after you turn on successfully you'll be the admin of the help center

screenshot 2018-11-20 at 3 42 23 pm

Documentation

https://www.intercom.com/help/

Thanks 😉
@phoenix-sec
Copy link

great khizar <3

@m7mdharoun
Copy link

Seems Interested 👍 waiting validation

@snapsecco
Copy link

Awesome bro

@EdOverflow EdOverflow added the vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service. label Dec 9, 2018
@ziak2677
Copy link
ziak2677 commented Mar 7, 2019

This Issue is vulnerable or not?

(Warning! Domain mapping upgrade for this domain not found. Please log in and go to the Domains Upgrades page of your blog to use this domain.)

If vulnerable then how i takeover through wordpress??
kindly guide.

@Avileox Avileox mentioned this issue Mar 17, 2019
Merged
@janmasarik
Copy link
Contributor

Doesn't seem to work in case the domain is (or maybe was already) taken:

image

The non-vulnerable page seems to be the same one:

image

However, it sometimes returns a different error message:

image

@PjMpire
Copy link
PjMpire commented Jun 6, 2019 •
edited
Loading

Takeover is edge case. A user can claim domain and turn off the helpcenter which then directs to the 404 page. I discovered that the domain can be registered if and when released by the current workspace owner.

image

@Phoenix1112
Copy link

hello bro.. i need help. I'm now a member of the site. I can't find which part of the target subdomain name to enter. please help with this.

image

which section do I need to enter from here?
@MuhammadKhizerJaved @PjMpire

@PjMpire
Copy link
PjMpire commented Aug 7, 2019

hello bro.. i need help. I'm now a member of the site. I can't find which part of the target subdomain name to enter. please help with this.

which section do I need to enter from here?
@MuhammadKhizerJaved @PjMpire

Articles tab on the left hand side -> settings -> setup the basics

@Phoenix1112
Copy link
Phoenix1112 commented Aug 7, 2019 •
edited
Loading

@PjMpire
Thanks for the help.
now I get an error when I try to register domain address... I get the warning that this domain name has already been taken. I see this image when I enter the target site. can't this subdomain be taken?

image3

@PjMpire
Copy link
PjMpire commented Aug 7, 2019

@Phoenix1112 as i mentioned in my previous post. Takeover is edge case. If the name has been registered but the help center has been disabled, takeover is not possible

@Securityteacher Securityteacher mentioned this issue Jan 6, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
vulnerable Someone has provided proof in the issue ticket that one can hijack subdomains on this service.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@janmasarik @EdOverflow @MuhammadKhizerJaved @PjMpire @m7mdharoun @phoenix-sec @Phoenix1112 @snapsecco @ziak2677