This is my talk from OWASP Appsec EU and also Security Fest 2017.
A few years ago, Frans and his team posted an article on Detectify Labs regarding domain hijacking using services like AWS, Heroku and GitHub. These issues still remains and are still affecting a lot of companies. Jonathan Claudius from Mozilla even calls “Subdomain takeover” “the new XSS”. Since then, many tools have popped up to spot these sorts of vulnerabilities. Frans will go through both the currently disclosed and the non-disclosed ways to take control over domains and will share the specific techniques involved.
DNS hijacking using cloud providers – No verification needed
DNS hijacking using cloud providers
– no verification needed
Security Advisor @detectify ( twitter: @fransrosen )
HackerOne #5 @ hackerone.com/leaderboard/all-time
Blog at labs.detectify.com
Talked here last year!
"The Secret life of a Bug Bounty Hunter"
First instance, 12th Oct '14
9 days later, 21st Oct '14
Response from services
“We're aware of this issue”
“My apologies for the delayed response.
We are aware of this issue”
“I had already identified that this is
a security issue”
* Check NOERROR for patterns
* SERVFAIL/REFUSED, Check NS for patterns
* NXDOMAIN, traverse up to apex, check:
NXDOMAIN|SERVFAIL|REFUSED|no servers could be reached
* Collect all subdomain names
* Sort them by popularity
* Sort www below all names with p>2
* Collect titles of all sites (or EyeWitness!)
* Filter out common titles + name of company
* Generate screenshots, create a image map
* Do it every day
* Push notification changes