Here's a quick breakdown:

1. Autogenerating CORS headers based on a regexp that can be tricked into allowing <safe.org>.evil.org.

2. A form POST encoded text/plain that gets interpreted as JSON to bypass CSRF check.

3. Using CORS origin check gaps to do an HTTP downgrade.

4. XSS-ATO by email address changes (this is pretty vanilla).

5. Sending “token[]=” to break PHP CSRF token check through type confusion.

6. Breaking a different CORS generator by smuggling the whitelisted domain into a ?urlparam=safe.org.

7. Setting content-type=text/plain; application/json to fake out browser check for JSON and bypassing CSRF at OVH.

8. Some fiddly and not super interesting CSP bypasses.

But hosting management also has a whole lot of potential for logical errors. I work at a B2B ISP that is also a managed service provider, and every now and then somebody calls for more self-service. I'm not against it, but it's full of landmines.

It starts with such simple things as account creation. We allow accounts with the appropriate roles to be used for several different customers, which means we cannot namespace them by tenant.

We used to give accounts usernames based on the first and last name, but that makes it very easy to leak which other accounts exists (when "John Doe" becomes "johndoe4" instead of just "johndoe", you can infer the existence of other accounts, and thus that other "John Doe"s are among our customer base). We had to change that, which isn't as easy as it sounds for a company that has been doing things a certain way for 25 years.

Potential logic errors and information leaks lurk in all places where you cannot namespace things because they are not fully under your control, which can be IP addresses (big customers bring their own address spaces, and IPv4 address space is too small for generous segmentation), Domains, email addresses, phone numbers and so on.

All this assuming the hacker would use a gift card to get a paid account to start.

Anecdotally, I've used Dreamhost for years as a domain host and have had nothing but positive experiences.

Originally I switched to them for being very vocally against SOPA, and they've consistently been on the right side of various Internet legislative issues.

If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.

"Endurance, who runs Bluehost, iPage, and HostGator:"

Also browsers automatic sending cookie enable many of these CSRF, consider JWT.

Amazing how PHP is still bitting developers.

https://en.wikipedia.org/wiki/Endurance_International_Group

They do seem like good people, I have no plan to move my own stuff from Dreamhost and I can't fault their customer service, but I also cannot recommend for stuff beyond vanity domains, fun side projects and so on because they've had so many issues that suggest a lot of stuff is kind of half-arsed. My home Internet service provider is also good hearted, but they've also been very _competent_ which is important, and I just can't honestly say that about Dreamhost.

Three (of many) Examples:

I own a .co.uk domain, and the people who run .co.uk have different requirements for WHOIS and for how domain transfers work. So Dreamhost would present me a generic "Here's how to change WHOIS" page and then it'd mysteriously fail, but actually their backend just didn't work with that entire 2LD, and domain transfer stuff would not work or it'd seem to work but then payment was rejected and the transfer doesn't go through...

I made a DNS change through Dreamhost's control panel, and after a reasonable period of time (maybe an hour?) of Dreamhost's three authoritative DNS servers only one had updated. So I talk to their support. They say I need to wait for it to "propagate" which is bullshit, these are authoritative servers, "propagating" data to the authoritative servers is Dreamhost's problem and if they can't do it in an hour what are they using, carrier pigeons? Then the support person shows me dig results they see locally for those DNS servers which don't match results I see, showing that actually these servers are either split brain or anycast groups, I ask about that, and the tech assures me that no, the answers they see are correct and that answers I see, by literally querying the same IP addresses, must need to "propagate" for a few hours more. After enough prompting they relent and say they'll "check" with someone about the DNS servers. Literally under 60 seconds after going to "check" the results are fixed. Huh, what a "coincidence".

Most hilariously one time they charged me for a year in advance entirely by accident, someone fat fingered a script that takes money from customer accounts. Now, like I said their customer service is good, I got the money refunded together with my costs for the currency difference between when they took the bogus transaction and when it was refunded rounded up. But if I had a $5000 contract that'd have hurt a lot more than it did for a few vanity sites.

I disagree. It's very easy to make such mistakes, often even to miss them in code review. You also cannot simply cover all potential errors in integration tests, because there are infinitely many potential errors you can make.

You need continuous or regular red-teaming or comparable security controls to reliably avoid such things, and you typically only have those at the really big and high-tech companies, or in highly attacked or regulated environments.

Always assume that service providers are:

- Blithering idiots until proven otherwise.

- Not performing a task that isn't explicitly committed to in the service description or contract. If something is left unsaid, that it isn't happening.

- Not performing a task that they aren't solely accountable for. If you "share" a responsibility, it is your responsibility.