The domain name system tree structure or DNS hierarchy has a root domain at the top and all the child nodes in the tree are called sub-domains.

learn more… | top users | synonyms

1
vote
1answer
32 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def....
0
votes
0answers
24 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
1
vote
2answers
56 views

Is there a difference in security between an IP address white list and a domain white list with TLS?

It seems to me that an IP address white list relies on easily spoofed information, while a domain white list, if it forces TLS, at least, relies on the validity of the certificate systems. I may be ...
1
vote
2answers
139 views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
5
votes
2answers
163 views

HSTS on a subdomain with includeSubdomains

Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS: Strict-Transport-Security: max-age=31536000; includeSubDomains ...
0
votes
1answer
26 views

Subdomain Bruteforcing when every request gets resolved?

Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved? In the case of a subdomain that doesn't exist, the server simply ...
4
votes
1answer
66 views

Is Exposing Real IP Through Subdomain A Security Implication?

It seems pretty common for websites to expose their real IP address through subdomains. Many DoS mitigation providers hide your real IP address for the core domain, but leave a subdomain exposed for ...
7
votes
2answers
301 views

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

We are hosting our own secure site with a wildcard certificate. However, we are working with a marketing company that provides landing pages on subdomains of our domain, on ip addresses supplied by ...
1
vote
1answer
99 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
4
votes
2answers
1k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
1
vote
2answers
199 views

Security implications of providing users subdomains on my domain?

I want to provide users with sub domains on my website. Users will provide an ip address and the sub domain they want and I will then use a DNS service to redirect to that IP through an A record or ...
4
votes
3answers
930 views

SSL Cert for sub.domain.com and www.sub.domain.com

I have a wildcard cert issued by godaddy for *.domain.com. currently, https://sub.domain.com works just fine. however, https://www.sub.domain.com does not work. Do I need a separate cert for ...
4
votes
1answer
280 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl hello2.test....
4
votes
2answers
448 views

Is it safe to point a (sub)domain to my home IP address?

I have my own website and I created a subdomain that points to my home IP address. It is useful for personal things like entering my domain for wake-on-lan and letting my friends enter it to join ...
2
votes
1answer
163 views

Is asking for credentials from a separate trusted domain an acceptable practice?

I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better. Serverfault.com is a stack exchange site on a different domain, however if you click to ...
2
votes
2answers
2k views

How could you find wildcard subdomains on websites?

Other than testing different URLs separately, is there anyway to find out if a website has a wildcard sub domain?
1
vote
2answers
271 views

Securely passing critical data to other domain

My company owns a domain A.com , and subsdiary is on B.com B.com redirects their users to A.com for accounts registrations. Post successfull registration , A.com logins that user ( User doesnt get to ...
0
votes
2answers
766 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
1
vote
3answers
279 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
1
vote
1answer
404 views

SSL on domain will affect un-secured sub-domain

I have a plan to buy a SSL certificate for my domain. I don't have much budget so I decided to buy standard SSL with no support for sub-domains. I have a WCF web-service that works on sub-domain. This ...
1
vote
0answers
130 views

secure authentication between subdomains hosted seperately

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a ...
1
vote
2answers
246 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: http://wiki....
21
votes
5answers
29k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...