During the information gathering phase I found that there is another domain pointing to the same IP that I'm auditing. The first one, "www.domain.com", is using TLS whereas the second one, "www-org.domain.com", isn't. The two domains offer the same funcionality. Is there any purpose of having the second domain?

  • 1
    If you try to reach the one that has TLS without using TLS (i.e. use http://www.domain.com/), does it redirect to the https version of the site? This is a fairly common setup, and if that's the case here then www-org.domain.com may exist as a don't-upgrade-to-https option. – Gordon Davisson Nov 4 '18 at 5:47
  • Yes, it redirects me to the HTTPS version. As the others peers have mentioned, it may exist due to an old system requirement. – ch4ik0 Nov 4 '18 at 8:40
  • I can think of lots of valid reasons, and lots of scenarios where this has happened more by accident than by design. From a security point of view, the key question is whether this facilitates some sort of exploit (none spring to mind). But from an audit point of view the next step would be for you to find the real reason for this - and you are asking the wrong people here. – symcbean Nov 4 '18 at 19:06

One of the reasons could be that some old system needs to operate with the one that don't have TLS support, but nowadays is a it strange that you don't have TLS support on the client


I have a similar scenario explaining why this could occur (And no, there is not a reason to have an unsecured domain other than maybe supporting a really old un-updatable client or making it insecure on purpose). Here is the story behind it how it ended having different domains and only 1 with SSL:

I used to work for a software factory. I developed an eCommerce for a client. We needed to have it running before a particular day. We got everything running, but HTTPS was still not configured (at least, the credit card payment was done in a redirected external system over HTTPS, so no credit cards could be captured...well, maybe phished). The client bought 2 new domains for the new eCommerce, and after some time we pointed the domain from it's old eCommerce to the new one (so it ended with more than one domain). We were going to add HTTPS on the second phase of the development, but our company broke and we could never do this.

After some time, a co-worker started freelancing for this client, and they needed to make available an HTTPS endpoint so other external system could send requests (updating stock or something similar) and it would refuse a non HTTPS connection. So I helped him setting SSL on one of the domains. The other domains didn't get an SSL certificate because the freelancer was already working a lot extra unpaid hours and hadn't enough time to set up everything correctly.

We advised the client that they really should secure all connections, but they unfortunately prioritized other things.

So the site has a domain with SSL and another domains without it (with the same exact functionality)


Finally, they have fixed the situation. There was also another domain without TLS "www-orgf5.domain.com" that was related to the F5 BIG_IP load balancer. They haven't told me the purpose of the domains but now when you try to access them you get redirected to "www.domain.com" so I conclude that these domains were not supposed to be there (which was the main purpose of the question).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.