# Using GitLab to monitor and hijack domains in mass quantity.

GitLab Pages let a repo claim unlimited custom domains without ownership verification, so an attacker pre-registers domains and hijacks them the moment they point at GitLab's IP.

- Payout: $750
- Severity: high
- Program: GitLab
- Credited: edoverflow
- Disclosed: 2018-02-21
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/312118
- Library page: https://bugbountylibrary.com/r/h1%3A312118
- Tags: domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:access-control vuln:business-logic vuln:subdomain-takeover

**Target:** GitLab Pages custom domains endpoint
**Root cause:** GitLab Pages stores any custom domain added to a repository without verifying ownership (no TXT record check) and allows unlimited domains per repo, so a domain is bound to the attacker's project before the legitimate owner points it at GitLab.
**Steps:**
1. Enumerate domains resolving to GitLab Pages IP `52.167.214.135` via SecurityTrails API (`/api/search/by_type/ip/52.167.214.135`)
2. Filter to live domains with `host $domain`
3. POST each domain to `https://gitlab.com/<user>/<repo>/pages/domains` with `pages_domain[domain]=$target` and a valid `authenticity_token`
4. Victim later sets an A record for their domain to `52.167.214.135`
5. GitLab serves the attacker's repository content on the victim's domain
**How found:** Noticed GitLab Pages accepts arbitrary custom domains without ownership verification and allows unlimited domains per repo; realized pre-registering domains means automatic hijack once DNS points to GitLab.
**Exploitation:** Attacker bulk-registers thousands of candidate domains to their Pages project via scripted authenticated POSTs. When any victim points their DNS A record at GitLab's Pages IP, GitLab already has the domain bound to the attacker's repo and serves attacker content on it, blocking the victim from claiming it.
**Escalation:** Scripted mass registration across multiple provider IPs (GitLab, GitHub, Shopify) to pre-claim domains at scale; 110 domains secured in under 5s.
**Insight:** On any PaaS with custom-domain features, test whether domain ownership is verified at claim time vs. at DNS-resolution time; if unverified and unlimited, you can pre-claim domains en masse and win the race when victims later point DNS at the platform.