2023-08-25 06:45:40 +00:00
id : lemlist-takeover
info :
2023-08-25 08:43:40 +00:00
name : Lemlist - Subdomain Takeover Detection
2023-08-25 06:45:40 +00:00
author : kresec
severity : high
2023-08-25 08:43:40 +00:00
description : |
The takeover will succeed when the target domain has a cname that points to the lemlist and in their account they only customize the domain in the tracking column so in the custom page column, as an attacker, they can enter the target domain.
reference :
2023-08-25 06:45:40 +00:00
- https://www.lemlist.com/blog/custom-tracking-domain
- https://kresec.medium.com/10k-site-affected-subdomain-takeover-via-lemlist-146cd0f11883
2023-08-25 11:15:35 +00:00
metadata :
max-request : 1
2023-08-25 06:45:40 +00:00
tags : dns,takeover,lemlist
http :
- method : GET
path :
2023-08-25 08:43:40 +00:00
- "{{BaseURL}}"
2023-08-25 11:09:23 +00:00
2023-08-25 08:43:40 +00:00
matchers-condition : and
2023-08-25 06:45:40 +00:00
matchers :
2023-08-25 08:43:40 +00:00
- type : dsl
dsl :
- Host != ip
2023-08-25 06:45:40 +00:00
- type : word
words :
- "Custom domain check"
- "app.lemlist.com"
2023-08-25 08:43:40 +00:00
condition : and
2023-10-20 11:41:13 +00:00
# digest: 4b0a0048304602210099908eacc7046289b5a30398972ec745cf09ab068ece8b8538ba44ddb5dd35a7022100d072f3859b82c4cda35df540e8a0fa3f30480d8d0a26634ee55eb5fb2c9d71fe:922c64590222798bb761d5b6d8e72950
