# Insecurity through Censorship: Vulnerabilities Caused by The Great Firewall

China's GFW DNS poisoning of keyword-containing subdomains returns attacker-reachable IPs, enabling Fastly domain takeover or cPanel XSS on any affected domain.

- Payout: Research
- Severity: medium
- Program: Chinese DNS infrastructure
- Credited: Assetnote
- Disclosed: 2025-02-12
- Write-up quality: 7/10
- Original: https://www.assetnote.io/resources/research/insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall
- Tags: domain:network impact:ato impact:integrity kind:research platform:research sev:medium tech:cdn technique:recon vuln:misconfiguration vuln:subdomain-takeover vuln:xss

**Target:** Authoritative DNS nameservers hosted in China (AlibabaDNS, Cloudflare China)
**Root cause:** The Great Firewall intercepts DNS queries containing censored keywords anywhere in the subdomain and returns spoofed A records pointing to a finite pool of unrelated IPs (Fastly, cPanel hosts, social media) instead of NXDOMAIN.
**Steps:**
1. Resolve `webproxy.id.<random>.example.com` against a China-hosted authoritative NS (e.g. `ns2.alibabadns.com`) repeatedly; observe rotating A records instead of NXDOMAIN.
2. Enumerate poisoned IP pool by resolving thousands of `N.webproxy.id.doesnotexist...` names and collecting unique A records.
3. Identify which returned IPs belong to Fastly; register a Fastly CDN profile and add `*.victim.tld` as a domain, pointing origin to attacker server.
4. Client-side JS generates random subdomains containing the keyword and loads an image from each until one resolves to the attacker's Fastly origin, confirming takeover.
5. Alternatively, iterate subdomains until one resolves to a cPanel host running a vulnerable version, triggering XSS in the victim origin.
**How found:** While running mass DNS resolution for ASM, noticed subdomains resolving to random, rotating IPs; traced to authoritative NS in China and distilled trigger to keyword `webproxy.id` embedded anywhere in the name, even for non-existent domains.
**Exploitation:** Attacker claims `*.victim.tld` on Fastly (if unclaimed) and serves content from their origin; victim users whose DNS crosses the GFW get poisoned to Fastly IPs and load attacker content, allowing HTTPOnly cookie theft, phishing, or defacement. cPanel variant fires XSS on the victim origin without needing Fastly.
**Escalation:** Chaining DNS poisoning with Fastly's permissive domain-claim model turns a censorship side-effect into full subdomain takeover of arbitrary affected domains.
**Insight:** When mass-resolving DNS, treat inconsistent A records from authoritative servers as a signal: test whether a specific substring in the query triggers spoofed answers, then map the returned IP pool to services (CDNs, panels) whose domain-claim or version weaknesses can be weaponized.