Subdomain Takeover through readme.io

[shoriful19]

Subdomain Takeover through readme.io

readme.io is another service which's subdomains can be taken over if it says "Project doesnt exist... yet!". There's a sign-up button and if someone does, then just simply entering the domain name on custom domain option can take over it.

Proof

I took over developer.bksah.com earlier. but didn't keep any PoC though. But it looks same like that as readme.io hosted sites are a subdomain of readme.io

https://xyz124.readme.io/inactive

Documentation

https://readme.readme.io/docs/introduction

Added in #55

[lecyberzilla]

[abd-4fg]

subdomains having ssl.readmessl.com cname are not vulnerable anymore:
Random hash value being generated in cname while setting up a custom domain

While subdomains having readme.io cname , might be vulnerable (if xxxx.readme.io not claimed by anyone else).