Segway Subdomain Takeover

During our research on the Segways’ domain space, we found a subdomain pointing to a third-party domain “pending for deletion” by its owner. Using a domain monitoring and backorder service, as soon as the third-party domain became available we got control over Segway’s subdomain.

According to responsible disclosure best practices, we provided Segway a detailed security advisory. This article is published after the security issue has been (silently) fixed by Segway.

Get Organized Now! Information Security Assessment Mindset Freebie

What to do? Where to begin? How to do it? Now you can relax and sit down. Thanks to David Sopas you can organize all your work with an assessment mindset available for free at Github. He did it to help him on his all-around assessments (pentest, bug bounty, red-team) keeping the workflow organized a...

How safe is your tax rebate e-invoice app? Learn how to protect yourself.

More and more apps are available in Google Play Store allowing to manage your invoices. Some apps are focused on small businesses in order to make quotes or invoices for clients, but other apps are also targeting individuals. For instance in Portugal, the government is encouraging people to ask for...