avatarTeri Radichel

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

3890

Abstract

.com</p><h2 id="48a2">Subdomain takeover</h2><p id="4a07">Warning: Be aware that you if you configure a subdomain and point it to a service where anyone can configure any subdomain, and then you fail to set up the service or delete your account with that service, someone else may set up a web site on your subdomain for you! In some cases this can facilitate attackers getting unauthorized data from you or your customers. I spoke about that type of attack, called subdomain takeover, at RSA 2020. You can watch the video here:</p> <figure id="0021"> <div> <div> <img class="ratio" src="http://placehold.it/16x9"> <iframe class="" src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FZv2jFISTHuE%3Ffeature%3Doembed&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DZv2jFISTHuE&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FZv2jFISTHuE%2Fhqdefault.jpg&amp;key=a19fcc184b9711e1b4764040d3dc5c07&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" frameborder="0" height="480" width="854"> </div> </div> </figure></iframe></div></div></figure><p id="5450">The bottom line is, don’t configure and leave things in your DNS records that you’re not using. It’s easy to do. Delete any records configured on your domains that you are not actively using to avoid problems.</p><h2 id="d223">Wildcard domains</h2><p id="0229">Another type of configuration you should be wary of is the wildcard domain configuration:</p><div id="09eb"><pre><span class="hljs-comment">.yourdomain.com</span></pre></div><p id="2e33">If you prefix your domain with an asterisk () it’s called a wildcard domain. That means any request to any subdomain associated with your domain will point to whatever application you have configured with the wildcard domain.</p><p id="a18f">So if I set up *.2ndsightlab.com and point it at my website hosted at https://secondsightlab.com, then I can visit:</p><div id="6f71"><pre><span class="hljs-selector-tag">a</span>.<span class="hljs-number">2</span>ndsightlab<span class="hljs-selector-class">.com</span> <span class="hljs-selector-tag">b</span>.<span class="hljs-number">2</span>ndsightlab<span class="hljs-selector-class">.com</span> c.<span class="hljs-number">2</span>ndsightlab.com</pre></div><p id="9caa">And all of those will end up at my website.</p><p id="8d3a">You can find lots of varying opinions on wildcard domains.</p><div id="df6f" class="link-block"> <a href="https://serverfault.com/questions/483576/is-a-wildcard-dns-record-bad-practice"> <div> <div> <h2>Is a wildcard DNS record bad practice?</h2> <div><h3>I asked my hoster to add three subdomains all pointing to the IP of the A record. It seems he simply added a wildcard…</h3></div> <div><p>serverfault.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*sBK-4zBk1PinbvHc)"></div> </div> </div> </a> </div><p id="a3ce">Here’s an example of a content confusion attack caused by a wildcard domain and something I’m currently looking into on a <a href="https://2ndsightlab.com/cloud-penetration-testing.html">penetration test</a> I’m working on.</p><div id="5b2e" class="link-block"> <a href="https://www.bleepingcomputer.com/news/security/nsa-warns-of-wildcard-certificate-risks-provides-mitigations/"> <div> <div> <h2>NSA warns of wildcard certificate risks, provides mitigations</h2> <div><h3>The U.S. National Security Agency (NSA) is warning of the dangers stemming from the use of broadly-scoped certificates…</h3></div>

Options

<div><p>www.bleepingcomputer.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div> </div> </div> </a> </div><p id="f78c">Wildcard domains can be useful in certain circumstances but most of the time they cause problems and should be avoided — especially if you don’t know exactly what you are doing and the implications of that configuration.</p><h2 id="f030">Disallowed subdomain formats for static sites in S3 buckets</h2><p id="d142">Just a note on something you should not do with domains for websites in S3 buckets. I think I tried to set up a subdomain with two prefixes on AWS for an S3 bucket like this and I couldn’t get it working. When I only used one prefix it worked. Just FYI to save anyone some point who might be trying to do that.</p><p id="75b7"><b>dev.test.</b>rainierrhododendrons.com</p><p id="c40f">^^^ Does not work for a static S3 web site.</p><p id="080d">I spent quite a while trying to figure out what the problem was when trying to do that because the error messages were not ideal.</p><div id="03be" class="link-block"> <a href="https://readmedium.com/thoughtful-error-handling-ca1064cda8da"> <div> <div> <h2>Thoughtful Error Handling</h2> <div><h3>Your error handler is one of your most important security defenses</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*hWOdEC85WwPVAPmT9JlrBA.png)"></div> </div> </div> </a> </div><h2 id="7bc5">Subdomains and domains configured in separate accounts</h2><p id="39d5">You can configure subdomains and domains in different AWS accounts. You can also leverage the same DNS name across multiple AWS accounts. You’ll just need to configure it correctly. You can find many examples of use cases for this scenario in the AWS documentation. I’ll be demonstrating one example in upcoming posts for static web site configuration in an account other than the one where you’re hosting your domains.</p><p id="1c12">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel: ~~~~~~~~~~~~~~~~~~~~</span> ⭐️ Author: Cybersecurity Books ⭐️ Presentations: Presentations by Teri Radichel ⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty ⭐️ Certifications: SANS ~ GSE 240 ⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec ⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span> 🔒 Request a penetration test or security assessment 🔒 Schedule a consulting call 🔒 Cybersecurity Speaker for Presentation</pre></div><div id="5a42"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="faf5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Subdomains — uses and attacks

ACM.235 Why you might want to configure a subdomain and how attackers can abuse them

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: AWS Security | Cloud Governance | DNS

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post I wrote about protecting git repositories using protected branches and rulesets.

In this post, I’m going to explain what a subdomain is and why I’m using this in my example of how to deploy a static website in an S3 bucket on AWS.

What is a subdomain?

A subdomain adds a prefix to a domain name. For example, I can add dev. in front of rainierrhododendrons.com.

dev.rainierrhodonrons.com

You can host different content on your primary domain (like rainier rododendrons.com) and a subdomain (dev.rainierrhododendrons.com).

Subdomains for a Secure Software Development Lifecycle (SDLC)

Applying changes directly to a production web site is generally not recommended. In order to test without breaking a production web site, you can deploy a subdomain and host the content you are testing on the subdomain.

I’m essentially going to create a copy of the rainierrhododendrons.com website for development and testing purposes and host it at dev.rainierrhododendons.com.

By the way, that’s my parent’s nursery where she they rhododendrons in the Pacific Northwest. I need to update the website to point to the Facebook page where they maintain a more current inventory:

rainierrhododendrons.facebook.com

Subdomain takeover

Warning: Be aware that you if you configure a subdomain and point it to a service where anyone can configure any subdomain, and then you fail to set up the service or delete your account with that service, someone else may set up a web site on your subdomain for you! In some cases this can facilitate attackers getting unauthorized data from you or your customers. I spoke about that type of attack, called subdomain takeover, at RSA 2020. You can watch the video here:

The bottom line is, don’t configure and leave things in your DNS records that you’re not using. It’s easy to do. Delete any records configured on your domains that you are not actively using to avoid problems.

Wildcard domains

Another type of configuration you should be wary of is the wildcard domain configuration:

*.yourdomain.com

If you prefix your domain with an asterisk (*) it’s called a wildcard domain. That means any request to any subdomain associated with your domain will point to whatever application you have configured with the wildcard domain.

So if I set up *.2ndsightlab.com and point it at my website hosted at https://secondsightlab.com, then I can visit:

a.2ndsightlab.com
b.2ndsightlab.com
c.2ndsightlab.com

And all of those will end up at my website.

You can find lots of varying opinions on wildcard domains.

Here’s an example of a content confusion attack caused by a wildcard domain and something I’m currently looking into on a penetration test I’m working on.

Wildcard domains can be useful in certain circumstances but most of the time they cause problems and should be avoided — especially if you don’t know exactly what you are doing and the implications of that configuration.

Disallowed subdomain formats for static sites in S3 buckets

Just a note on something you should not do with domains for websites in S3 buckets. I think I tried to set up a subdomain with two prefixes on AWS for an S3 bucket like this and I couldn’t get it working. When I only used one prefix it worked. Just FYI to save anyone some point who might be trying to do that.

dev.test.rainierrhododendrons.com

^^^ Does not work for a static S3 web site.

I spent quite a while trying to figure out what the problem was when trying to do that because the error messages were not ideal.

Subdomains and domains configured in separate accounts

You can configure subdomains and domains in different AWS accounts. You can also leverage the same DNS name across multiple AWS accounts. You’ll just need to configure it correctly. You can find many examples of use cases for this scenario in the AWS documentation. I’ll be demonstrating one example in upcoming posts for static web site configuration in an account other than the one where you’re hosting your domains.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
Subdomain
Takeover
Content Confusion
Wildcard
Route53
Recommended from ReadMedium