> For the complete documentation index, see [llms.txt](https://melbadry9.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://melbadry9.gitbook.io/blog/dangling-dns/xyz-services/ddns-worksites.md).

# Dangling DNS: Worksites.net

Another service vulnerable to subdomain takeover

This post is the write-up about subdomain takeover vulnerable service [Worksites](https://github.com/EdOverflow/can-i-take-over-xyz/issues/142) that I found back in April 2020. Although this is a paid service, It's possible to create a PoC without having to purchase the service.

## Worksites.net

[Worksites.net](https://worksites.net) is a web service for building websites for contractors and growing businesses, which support custom domains feature.

## Service Detection

`A` record should be pointing to static IP address `69.164.223.206`

```
worksites.melbadry9.xyz. 60     IN      A       69.164.223.206
```

I use the following [Nuclei](https://github.com/projectdiscovery/nuclei) template to check for possible candidates.

{% tabs %}
{% tab title="YAML" %}

```yaml
id: detect-worksites

info:
  name: worksites.net service detection
  author: melbadry9
  severity: info
  tags: dns

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 2
    matchers:
      - type: word
        words:
          - "69.164.223.206"
```

{% endtab %}
{% endtabs %}

## Takeover Detection

We should see a similar error page to verify whether the subdomain takeover may be possible.

![Vulnerable Subdomain Error Page](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-fdcaec182e77f588dc73269a663dec978b60b7f2%2FScreenshot_3.png?alt=media)

### Fingerprint

To detect a vulnerable subdomain, we use the following fingerprint based on the HTTP response; we confirm whether the subdomain is vulnerable or not.

```javascript
{
    "status_code": 404,
    "text": [
        "Company Not Found",
        "Hello! Sorry, but the website you’re looking for doesn’t exist."
    ]
}
```

I use the following [Nuclei](https://github.com/projectdiscovery/nuclei) template to check for the vulnerable subdomain.

{% tabs %}
{% tab title="YAML" %}

```yaml
id: worksites-takeover

info:
  name: worksites.net subdomain takeover
  author: melbadry9
  severity: high
  tags: takeover

requests:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Company Not Found"
          - "Hello! Sorry, but the website you’re looking for doesn’t exist."
        condition: and
      - type: status
        status:
          - 404
```

{% endtab %}
{% endtabs %}

## Takeover Steps

* Register an account on [Worksites.net](https://worksites.net)
* Go to `https://app.worksites.net/website/domain-name`
* Set `Your domain name` to subdomain we want to takeover `worksites.melbadry9.xyz`

![Takeover Steps](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-d0186f7dd91b49bec46664660b1dede88b0e8804%2FScreenshot_5.png?alt=media)

* Visit `worksites.melbadry9.xyz`
* Create a screenshot as PoC. We can publish the site for $27.00 per month.

![Takerover by melbadry9 PoC](https://3480101207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUq9DKNaJ81oWn3yGUp%2Fuploads%2Fgit-blob-a40a68f2a4315915227889b989ac348e800afe68%2FScreenshot_4.png?alt=media)

## Can I takeover XYZ? - Issue

I opened an issue on [GitHub](https://github.com/EdOverflow/can-i-take-over-xyz) regarding this service:

{% embed url="<https://github.com/EdOverflow/can-i-take-over-xyz/issues/142>" %}

{% content-ref url="/pages/-MUq9GH4M78EcjjG9LSI" %}
[About Me](/blog/readme.md)
{% endcontent-ref %}