4

I've been learning more about subdomain takeovers and trying to find other risks of them.

I have a fairly simple question; what can you do with access to a website via a crossdomain.xml file?

(ex. you takeover a.example2.com and example.com/crossdomain.xml says <allow-access-from domain="*.example2.com"/>)

1 Answer 1

2

Let's call them vulnerable.com and malicious.com instead, with vulnerable.com hosting a crossdomain.xml file which allows access by malicious.com.

When a victim visits malicious.com (e.g. after clicking on a phishing email), a Flash page hosted on malicious.com could instruct the victim's Adobe Flash plugin to send any request to vulnerable.com reading the corresponding responses. Here you can find an example of how to exploit it.

If at the time of the attack the victim is logged into vulnerable.com, then malicious.com will be able to act on her behalf on vulnerable.com, for example to read or change registration details bypassing CSRF defences.

Even if the victim is not logged in some attacks are possible, for example posting anonymous comments, logging in the victim as another user to perform abusive activities, attempt a DDoS by sending requests from many clients etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .