4 ms·
Does this mean all domains which allow arbitrary JS on subdomains are vulnerable? Is this why heroku app domains are x.herokuapp.com and not x.heroku.com?
by revorad 14y ago
Does this mean all domains which allow arbitrary JS on subdomains are vulnerable? Is this why heroku app domains are x.herokuapp.com and not x.heroku.com?
- flurdy 14y agoCedar stack apps are herokuapp.com, but their older Bamboo stack is heroku.com. But I don't think you can create any new ones with Bamboo, thankfully!
- homakov 14y agoyes it does. yeah, *.heroku.com was a bad idea too.
- landr0id 14y agoI believe that * .heroku.com points to * .herokuapp.com
- homakov 14y agohttps://www.google.com/search?q=site%3Aheroku.com&aq=f&oq=site%3Aheroku.com&aqs=chrome.0.57j58.2358&sourceid=chrome&ie=UTF-8 https://www.google.com/search?q=site%3Aheroku.com&aq=f&#... About 598,000 results (0.23 seconds)
- landr0id 14y agoSome do redirect to * .herokuapp.com, though. For instance: http://blacklistapp.heroku.com http://blacklistapp.heroku.com redirects to http://blacklistapp.herokuapp.com http://blacklistapp.herokuapp.com. I wonder if they switched it over for newer instances?
- homakov 14y ago1) find or buy at least one heroku.com subdomain 2) PROFIT 3) MOAR PROFIT 4) EVEN MOAR PROFIT