# Dangling DNS: Announcekit

This post is the write-up about the subdomain takeover vulnerable service [Announcekit ](https://github.com/EdOverflow/can-i-take-over-xyz/issues/228)that I found. Although this is a paid service, It's possible to create PoC without purchasing the service during the trial period.

## Announcekit.app

[AnnounceKit ](https://announcekit.app)is a user communication platform that helps you announce product updates to increase feature adoption.

## Service Detection

`CNAME` record should be pointing to `cname.announcekit.app`

```
akit-tk.melbadry9.xyz.  42      IN      CNAME   cname.announcekit.app.
```

I use the following [Nuclei](https://github.com/projectdiscovery/nuclei) template to check for possible candidates.

```yaml
id: detect-announcekit

info:
  name: Announcekit service detection
  author: melbadry9
  severity: info
  tags: dns

dns:
  - name: "{{FQDN}}"
    type: CNAME
    class: inet
    recursion: true
    retries: 2
    matchers:
      - type: word
        words:
          - "cname.announcekit.app"
```

## Takeover Detection <a href="#takeover-detection" id="takeover-detection"></a>

We should see a similar error page to verify whether the subdomain takeover may be possible.

![Vulnerable Subdomain Error Page](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-332a9c618791bddbce5cf06e9fa1b844059e9587%2FScreenshot_1.png?alt=media)

## Fingerprint

To detect a vulnerable subdomain, we use the following fingerprint based on the HTTP response. we confirm whether the subdomain is vulnerable or not.

```javascript
{
    "status_code": 404,
    "text": [
        "Error 404 - AnnounceKit"
    ]
}
```

I use the following [Nuclei](https://github.com/projectdiscovery/nuclei) template to check for the vulnerable subdomain.

```yaml
id: announcekit-takeover

info:
  name: Announcekit Takeover Detection
  author: melbadry9
  severity: high
  tags: takeover
  reference: https://announcekit.app/docs/custom-host

requests:
  - method: GET
    raw:
      - |
        GET / HTTP/2
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    
    redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Error 404 - AnnounceKit'
      
      - type: status
        status:
          - 404
```

## Takeover Steps <a href="#takeover-steps" id="takeover-steps"></a>

* Register an account on [AnnounceKit](https://announcekit.app)​
* Go to `https://announcekit.app/dashboard/settings/feeds`
* Set `Custom Hostname` to the subdomain, we want to takeover `akit-tk.melbadry9.xyz`

![Takeover Steps](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-946160cf25b3afa51f7b5abccd190c0336cb8801%2FScreenshot_2.png?alt=media)

* Visit `https://kit-tk.melbadry9.xyz`

![PoC](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-c974f2f266b4fa52c86937dc423cae3dc7937b65%2FScreenshot_3.png?alt=media)

## Can I takeover XYZ? - Issue <a href="#can-i-takeover-xyz-issue" id="can-i-takeover-xyz-issue"></a>

I opened an issue on [GitHub ](https://github.com/EdOverflow/can-i-take-over-xyz/issues/228)regarding this service:

{% embed url="<https://github.com/EdOverflow/can-i-take-over-xyz/issues/228>" %}
