Subdomain Takeover via HubSpot

[m7mdharoun]

HubSpot

Proof

Example of https://hackerone.com/reports/38007

Doc

I do the same takeover last 2 days so The vulnerability is still exist .

[codingo]

@m7mdharoun I'm pretty familiar with this one and somewhat doubt your claim. Could you please provide a link to your more recent issue (if disclosed) or at minimum some further information?

[m7mdharoun]

@codingo I've disclosed the Bug Report but without the premssion of PayPal So someone report Hackerone Support and They warning me Poc here

FingerPrint : Domain Not found

[codingo]

Excellent, thank-you for the prompt response. I'll update the repo shortly.

[m7mdharoun]

@codingo Please check your twitter messages I've sent you the POC link

[alanbriangh]

Hi, another example here:

https://hackerone.com/reports/407355

(He didn't say it was "Hubspot", but he said "this report is same as of this one:- https://hackerone.com/reports/38007"

[jub0bs]

Here is a recent example, but it contains few details about the PoC: https://hackerone.com/reports/335330

[soareswallace]

Both examples above were reports written 2 years ago, but disclosed recently.

[jub0bs]

@soareswallace Ah yes, I had overlooked that. Thanks.

[rohan-birtia]

This is no longer possible.

[hellsing032]

Halo, i discovered a domain connect the hubspot but went i regist it the domain i want to takeover is request the verification, is still vuln or no?