0

If I publicly list my company's intranet and extranet website addresses, is it a risk?

  • 2
    "Dear colleagues. Due to a technical problem, all pages on intranet.ourcompany.local that require you to enter a username and password may currently cause stability problems. We installed a workaround on evilguy.com and advise you to temporarily log in there until we manage to sort things out ..." – Hagen von Eitzen May 14 '19 at 19:59
2

If you are talking about the Internet address such as example.com, then you are safe. That is what others will use to find your company website.

If you are talking about the intranet address such as example.net, not really unless it also reveals the network topology, then it is possible to have an issue as knowing the network topology can make a dhcp and dns poisoning attack possible.

2

This is a bad idea for several reasons.

There is no need to do so.

This should be the most obvious one. If an outside source can't connect to internalapp.ourcompany.local, then I see no reason to share this link at all.

The data might be classified.

Information inside a company is almost always classified in some way. Some data is classified as public, such as marketing material, and free to be published. Other data is classified as internal or similar, meaning that it has to stay within the company.

The exact kinds of classifications in your company, there should be a policy. If not, urge management to create one!

Sharing "internal" data publicly without explicit permission could be a reason for termination.

The data might allow an attacker to get insights into your company.

You might think "What can an attacker gain by knowing ourapp.ourcompany.local?". Well, what if it's an URL like oracledb-dev.ourcompany.local? What about git.ourcompany.local?

Just the URL can give an attacker an idea of what technologies your company is using. Depending on how valuable of a target your company is, spear phishing or social engineering might become easier.

You have to realize that the way humans trust each other is different from computers. Computers use cryptography to "proof" that they are who they claim to be, or that they have certain rights. Humans on the other hand "judge" others based on how they act and, among others, about what they know. If an attacker has lots of internal knowledge, then he immediately seems more trustworthy.

In Summary, don't do it.

You have no reason to share internal data, it might be against company policy to share internal data, and you could help an attacker by sharing internal data.

1

It's certainly not a good idea. It will make it much easier for any attacker who finds a way to pivot inside your network (via SSRF, compromised bastion host, malware on an employee box, etc.) to get access to sensitive data. While they'd almost certainly be able to get there eventually, it's more likely that they'd be detected before getting whatever they're looking for (either because they'd need to run more scans or simply because it would take longer) if they are going in blind than if they are armed with knowledge of internal hostnames and/or IPs.

0

If you have a CDN, then it's better not to show your real extranet IP, and make sure only the CDN nodes can connect to your real extranet IP's specific ports for web services, eg. if you are using Cloudflare as CDN provider, you should add the following IPs to your firewall as white list, IPv4,IPv6. If you don't have a CDN configured, there is no difference, the extranet IPs is just out there, you don't have to explicitly publish them.

There is no need to show your intranet IPs on extranet Website, you might be exposed to SSRF attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.