Subdomain Takeover — Proof of Concept

This benign page is served on skydesperados-poc.docs.ems.eos.comcast.com — a *.comcast.com host — over a GitHub-issued valid TLS certificate, from a repository controlled by the researcher.

It demonstrates that the dangling wildcard DNS record *.docs.ems.eos.comcast.com → entos-ems.github.io allows an arbitrary party to publish content on Comcast subdomains.

No Comcast data was accessed, modified, or impacted. This page will be removed on request.

Authorized security research · @skydesperados

Reported to Comcast via Bugcrowd. Remediation: remove/scope the wildcard DNS, reclaim unclaimed hosts, verify comcast.com at GitHub org level.