1

If a web-app is using cloudfront as CDN, what happens if I ping the domain? Am I pinging the cloudfront endpoint? Or the web-app server? Why is it DNS resolution resolves to different IPs in this case?

One example is when I ping the domain, I use the IP on shodan and see that it's a cloudfront hostname. I'm guessing this means I'm reaching the cloudfront endpoint and not the web-app?

2

If a web-app is using cloudfront as CDN, what happens if I ping the domain?

You are pinging CloudFront, not the domain. The DNS entry for the domain point to CloudFront, and CloudFront stays in the middle between you and the domain.

The name resolves to different IPs for load balancing. As CloudFront primarly is a cache (among other things), answering with different IP addresses means clients will connect to different cache endpoints and share the load.

this means I'm reaching the cloudfront endpoint and not the web-app?

Exact. You don't know the endpoint real IP, and hiding its own IP is one reason for someone to use CloudFront or any other CDN.

3
  • How should one approach a web-app pentest? If I can't directly scan the IP (since Id be scanning the cloudfront edge server I guess?), is the only approach to assess it layer 6-7? – Bryan Mar 17 at 18:01
  • Yes, you will be only accessing the application. You could poke around to see if you can force the application to disclose its real IP. – ThoriumBR Mar 17 at 18:05
  • Thanks for everything - if I feed a domain (behind a CloudFront CDN) to Nikto, what exactly is being scanned? Is it the CloudFront distribution server for your domain or the web-server on the S3 bucket? Im looking at my nMap results and the version says "Amazon CloudFront http". – Bryan Mar 17 at 18:15
1

Am I pinging the cloudfront endpoint? Or the web-app server?

I am going to argue those are the same thing. The cloudfront endpoint is the front door to the cluster of things that together are "the server".


When you think about cloud-native web apps, thinking about there being a single "web-app server" is almost certainly wrong.

Borrowing an image from AWS docs that shows one possible way to configure a backend behind CloudFront:

Example AWS CloudFront network diagram

It's possible that a site is hosted by a single EC2 VM sitting behind CloudFront, but it's becoming more common for the backend to be a collection of distributed components running on different hosts, possibly distributed across datacentres in different continents. A single request from your browser may end up touching a half-dozen or more different "endpoint servers" in the AWS backend. That's just the nature of designing modern scalable server backends for a distributed cloud like AWS.

0

Just adding to the answers already given.

Yes, when you ping the domain, you will hit the cloudfront edge location, and not the origin. The origin could be web app or S3, or things like an Application Load Balancer etc.

In terms of security though, you'd typically place a WAF in front of cloudfront, to detect and block attacks. But to mitigate WAF bypasses, you need to ensure that all traffic flowing to your web-app is limited to cloudfront, otherwise an attacker might be able to bypass Cloudfront+WAF, and hit your webapp directly via the public ip of the webapp server.

Also, if you web-app is publicly accessible and has a public ip address, it will show up on Shodan searches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.