BBLABSBBLABS
LaboratoriosAprender desde 0FuncionesPreciosTestimoniosDetrás de BBLABS
  1. Home
  2. Labs
  3. Subdomain Takeover via Dangling CNAME
Medium30 min

Subdomain Takeover via Dangling CNAME

By @gorka

Portal del gobierno ficticio con un subdominio legacy que apunta a un repositorio de GitHub Pages inexistente. El atacante debe descubrir el subdominio, identificar el CNAME dangling, reclamar el repositorio y tomar control del subdominio

This hack was reported with no reward

788 views22 completedUpdated Nov 2026
Log in to start

Learn to find this bug

A real YesWeHack hack, reproduced for you to practice.

Create your account and practice real bugs that got paid. Download the environment, find it and learn the exact technique — your path to your first bounty.

650

hunters training

50

labs from real hacks

380

completions

$12,000

paid out for these bugs

40 flags captured this week
Create account
I already have an account

Access to all labs · no commitment · cancel anytime

Hackers who solved it· 8

r00thor1
@r00thor26 days ago
sharat chandra2
@sharat chandraOct 2026
3nk13
@3nk1Sep 2026
bizedtv
@bizedtvSep 2026
emperador
@emperadorSep 2026
MA
@maxioliveraSep 2026
benjaminnocervigni
@benjaminnocervigniAug 2026
zynap
@zynapAug 2026

Objectives

1
Reconocimiento → explorar la web del gobierno
2
Inspeccionar código fuente → descubrir subdominio en footer/robots.txt
3
Añadir portal.gobierno.gob.local al /etc/hosts
4
Visitar subdominio → GitHub Pages 404
5
Identificar el CNAME target (hash.github.io)
6
Crear el repositorio en GitHub (o usar /api/claim para simulación)
7
Subir contenido → subdominio tomado
8
Flag: d41d8cd98f00b204e9800998ecf8427e

Information

Platform
YesWeHack
Difficulty
Medium
Duration
30 min
Bounty
Sin recompensa
Completed
22
Creator
gorka@gorka
Updated
Nov 2026

Download the environment

Reproduce it and find the bug yourself

Create account

Tools

NavegadorGitHubTerminal

Prerequisites

  • Conocimineto Básico Sobre DNS
  • Cuenta de GitHub
  • Modificar Hosts del Sistema

Tags

Business Logic

Achievement you'll earn

Solve this lab to unlock this shareable achievement

Solve this lab to unlock this shareable achievement

Community writeups

Free · no account

The checklist I run on every new target

47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.

Unsubscribe in one click, from any email.

Setup

Añadir al /etc/hosts:

127.0.0.1 gobierno.gob.local
127.0.0.1 portal.gobierno.gob.local

Desplegar:

./autodeploy.sh
# o: docker compose up --build

Acceder: http://gobierno.gob.local:1000

The community

This isn't a platform with users.It's people breaking the same things you are.

Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.

Join the BBLABS community on Discord
Join the Discord

Free and open. You don't need a BBLABS account to join.

BBLABS LogoBBLABS

Laboratorios de hacking basados en hackeos reales. Aprende practicando sobre entornos vulnerables, con la resolución explicada paso a paso.

Producto

  • Funcionalidades
  • Precios
  • Labs
  • Aprender desde 0
  • Blog
  • Detrás de BBLABS

Legal

  • Términos
  • Privacidad
  • Cookies
  • Entrar
  • Crear cuenta

Para cualquier duda, bug, soporte o sugerencia puedes escribir a team@bblabs.es

© 2026 BBLABS. Todos los derechos reservados.