0

Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the whitelisted value in the subdomain.

E.g. example.com only allows requests from domains containing example.com. The attacker performs a request from example.com.attacker.com, which passes.

I want to exploit such a situation, and I am looking for an easy way to do so. Setting up explicit subdomains requires a dedicated domain with the possibility to add subdomains, which cost money, may require IT approval, and has to set up for every new domain I want to exploit. Is there an easier way? Is there a catch-all domain name or trick I can use?

2
  • 1
    If you're doing this just for demonstration purposes on an intranet, you could run your own DNS server and list the domains in a zone file (or even simpler: list the domains in a hosts file on the demo computer). On the actual internet and without a MITM scenario, you can't affect how other people resolve their DNS queries except for domains that you hold. But you could use wildcards so that you don't have to manually add subdomains. E.g. you can run your own nameserver for your domain and have it respond to every subdomain A record request with the IP address of your web server.
    – amon
    Dec 22, 2021 at 16:58
  • 1
    Configure a wildcard DNS entry so one IP can listen to all unassigned hosts for a given domain. If IT doesn't approve that, buy a new domain (<$15) and use that.
    – Adam Katz
    Dec 22, 2021 at 18:17

1 Answer 1

1

... has to set up for every new domain I want to exploit. Is there an easier way?

Easy for DNS, not possible for HTTPS, hosting depends on your provider.

DNS wildcards span multiple levels. So configuring a DNS wildcard for *.ning.com will also work for hello.world.ning.com and victim.example.org.ning.com.

You don't need your own DNS server, or a special DNS server. Any DNS server can configure wildcards, and those work for arbitrary levels of subdomains. If you are especially frugal, it's also possible to use a DynDNS or free DNS provider to register a specific subdomain, but free wildcard domains are rare.

HTTPS certificate wildcards do not span multiple levels. So the wildcard certificate *.ning.com is valid for world.ning.com, but not for hello.world.ning.com. So if you want HTTPS on your domain, you have to set it up explicitly.

Not all hosting providers support hosting content on wildcard domains. Even if you configure the wildcard DNS to point to your hosting provider, they have to serve the correct content, depending on the Host header. Not all hosting providers can do this for wildcard domains.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .