0

I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/

However the requisites to do that is to include all subdomains of the domain given. This makes a problem to websites that are really big, they just want to preload the domain and not the subdomains...

1)is there any way to make this work? 2) does the preload of the domain preloads subdomains too? i may be getting all wrong

personal example/experience:

i was doing pentesting against a website example.com and it was preloaded and added to the hstspreload list, however i found that vulnerable.example.com subdomain didn't have HSTS header and it wasn't preloaded, so of course it was vulnerable to mitm attacks, but how? it had the domain preloaded, and to add it there you need to add subdomains too... so was this an exeption or what happened here?

Improve this question

1 Answer 1

Reset to default
2

If I recall correctly, when HSTS preload was launched, it did not need to have subdomains included.

Now, the requirements state :

Serve all subdomains over HTTPS. In particular, you must support HTTPS for the www subdomain if a DNS record for that subdomain exists.

  1. Serve an HSTS header on the base domain for HTTPS requests:
    • The max-age must be at least 31536000 seconds (1 year).
    • The includeSubDomains directive must be specified.
    • The preload directive must be specified.
    • If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (rather than the page it redirects to).

BUT, how are they going to check this ?

Say you want to register "example.com" but not "vuln.example.com" and other subdomains. I would recommend you trying :

  • Do not include subdomains in your DNS, but do a redirect upon request from your server
  • In your headers, do not include "subdomains"
  • on https://hstspreload.org Register only "example.com", and "www.example.com" if you have an entry for this in your DNS and do not register for subdomains

Then, if on hstspreload.org they tell you can't submit for your domain because subdomains is not included, I guess you're scr***d. :/

Please share if you manage to do it ! :)

Improve this answer
3
  • It does say pretty clearly that "the includeSubDomains directive must be specified". Also, not including subdomains is a potential security risk, as any subdomain will get all of the top-level domain's cookies (and if the subdomain is not being accessed over HTTPS and any of the cookies lack the Secure flag, they'll be sent in the plain-text request), and any subdomain can plant cookies for the parent domain (even if there's already a Secure cookie for the parent domain, and the subdomain is being accessed insecurely, an attacker could still set a cookie for the parent).
    – CBHacking
    May 24, 2019 at 20:27
  • I know that it says that, the requirement is in my answer. But it's worth a try if it really is checked. Then, the op clearly asks how this can be achieved, thus not seeking to secure subdomains. Since the op did a pentest with that scope, I suppose they know what this implicates.
    – Bytemare
    May 24, 2019 at 20:45
  • "do not register for subdomains" - but www.example.com is a subdomain of example.com. You can't register www.example.com, only example.com.
    – David Klempfner
    Jun 28, 2021 at 22:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .