{"id":46,"date":"2025-06-14T09:28:41","date_gmt":"2025-06-14T09:28:41","guid":{"rendered":"https:\/\/pare.sh\/blog\/?p=46"},"modified":"2025-06-15T15:43:25","modified_gmt":"2025-06-15T15:43:25","slug":"subdomain-takeover-on-ngrok-now-fixed-by-ngrok","status":"publish","type":"post","link":"https:\/\/pare.sh\/blog\/subdomain-takeover-on-ngrok-now-fixed-by-ngrok\/","title":{"rendered":"Subdomain Takeover on Ngrok (Now Fixed by Ngrok)"},"content":{"rendered":"\n

<\/h4>\n\n\n\n

Subdomain Takeovers<\/strong> are a common but often overlooked vulnerability that can have serious consequences. They occur when a subdomain points to an external service (like GitHub Pages, Heroku, or Ngrok) that is no longer in use, but the DNS record is still active. This opens the door for an attacker to claim that resource and serve content under your domain, potentially leading to phishing, brand abuse, or worse.<\/p>\n\n\n\n


When visiting a vulnerable subdomain like:<\/p>\n\n\n\n

http:\/\/subdomain.example.com
<\/code><\/pre>\n\n\n\n
You\u2019d see this error:<\/p>\n\n\n\n
Tunnel subdomain.example.com not found
<\/code><\/pre>\n\n\n\n
This usually means the subdomain has a dangling CNAME, pointing to a service that\u2019s no longer active.<\/p>\n\n\n\n
If you inspect the DNS records, you might find a CNAME entry like:<\/p>\n\n\n\n
xxxxxxxx.cname.us.ngrok.io
<\/code><\/pre>\n\n\n\n
This indicates that the domain was using Ngrok\u2019s custom subdomain feature\u2014which becomes exploitable when the tunnel is no longer active.<\/p>\n\n\n\n
\n\n\n\n
Exploiting the Takeover (Prior to Fix)<\/h4>\n\n\n\n
To exploit this (when it was still open), you’d need a paid Ngrok account, since custom subdomains are only available for premium users:<\/p>\n\n\n\n
\n\n\n\n
\u2705Step-by-Step Exploitation<\/h4>\n\n\n\n
    \n
  1. Create a Ngrok account<\/strong>
    \u2192 Sign up at ngrok.com<\/a><\/li>\n\n\n\n
  2. Set up Ngrok locally<\/strong>
    \u2192 Follow the guide:     https:\/\/dashboard.ngrok.com\/get-started<\/a><\/li>\n\n\n\n
  3. Reserve the subdomain<\/strong>
    \u2192 Go to     Ngrok Reserved Domains<\/a>
    \u2192 Enter the vulnerable subdomain (e.g., subdomain.example.com<\/code>) and click Reserve<\/strong>
    \"\"
    <\/li>\n\n\n\n
  4. Run the tunnel<\/strong> on your local machine: 
    ngrok http -region=us -hostname=subdomain.example.com 80<\/code> <\/li>\n<\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Now, the subdomain is yours. Any request to subdomain.example.com<\/code> would be routed to your local server via Ngrok.
    <\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    <\/p>\n\n\n\n
    \n\n\n\n
    Official References<\/h4>\n\n\n\n