I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME >

xyz.example.com.ent.syn-alias.com  (same 404 page)

Which is pointing to another CNAME >

xyz.example.com.ent.cmh.syn-alias.com (same 404 page)

I did a quick search and it seems that syn-alias.com is provided by synacor.com

Is this domain vulnerable to subdomain takeover? It doesn't seem that there's a registration page or a check availability page in synacor.com website. How can I test if it's vulnerable to subdomain takeover?

  • Do you know how to test for subdomain takeovers in general? – schroeder Apr 1 '19 at 13:42
  • I just learned about this issue. I didn't know there were services that did not check the domain ownership. That's ridiculous. AFAIK, to set up anything on Google you need to verify the domain ownership (either by uploading a file, or adding a TXT DNS record, etc.), so Google does "the right thing". Apparently lots of other providers don't: github.com/EdOverflow/can-i-take-over-xyz . Synacor is not listed there, you'll probably have to check their setup process yourself. – reed Apr 1 '19 at 14:12
  • @reed, the main domain is good (example.com). This subdomain was probably abandoned and they forgot to remove their dns entries. However i'm not sure if it's possible to takeover synacor or zimbra hosts. – Jyosk Natalm Apr 1 '19 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.