0

I am a website developer (mainly using MVC.NET). Recently, we have been contacted by a hacker. He claimed that he knows our admin URL. The problem is we do not publish or put the admin URL anywhere on our webpage. The only place where the URL is listed is in CloudFlare DNS as A record.

So, when I challenge the hacker and, like magic, he/she pasted my admin URL.

I have spent days on google to find out how is it possible to find admin URL (which is part of a subdomain - but I never publish the URL). For curiosity - here is our admin URL xbda-www3345-hilo.mydomain.com. The question is, how is it possible that anyone could know the subdomain of xbda-www3345-hilo?

The IP address that hit the domain is msnbot. How is it msnbot (a search engine crawler) knows my admin domain?

Every time I change the admin domain, he would find out my admin domain after a few weeks. How is it possible?

I hosted my website on Azure VM machine (Windows 2016).

Improve this question
8
  • 4
    A better question is why you attempt to keep a URL secret. It may leak through browsers submitting it to URL screening systems, leading to search engines visiting it... You should rely on authentication, not obfuscation of the URL.
    – vidarlo
    Commented Aug 2, 2022 at 6:36
  • 2
    You can't rely on security by obscurity. Do you have HTTPS for your admin panel? If so, do you use a wildcard certificate or does the certificate mention the full domain? All trusted certs are listed in public certificate transparency logs.
    – amon
    Commented Aug 2, 2022 at 6:36
  • Hi vidarlo & amon, yes we have authentication and yes, all of our websites are using HTTPS. We obscure the admin page to prevent "brute force" login. I am very curious, how is it possible for the hacker to know my admin domain?
    – Sam
    Commented Aug 2, 2022 at 6:45
  • 1
    Do you use Edge to connect to the admin portal?
    – schroeder ♦
    Commented Aug 2, 2022 at 7:04
  • 2
    Have you used dig or something similar to see if these subdomains are publicly discoverable using DNS?
    – schroeder ♦
    Commented Aug 2, 2022 at 7:07

1 Answer 1

Reset to default
5

Whilst it's not possible to know definitively, based on the comment from @amon and your response one way which an attacker could find your admin URL would be to use Certificate Transparency Logs.

There are several good examples of exactly how these logs work (for example this one) however the basics is that every TLS certificate issued by one of the Certificate Authorities trusted by the major browsers is placed in a public log, so that users can validate that the certificate of sites the visit is a valid one, and to help mitigate the risk of attackers tricking certificate authorities into issuing certificates for sites they don't own.

The flip-side of this is that anyone can get a list of newly issued certificate which include the DNS name of the host (unless you're using a wildcard certificate), allowing them to find the site.

With that said, knowledge of the URL shouldn't, on its own, allow an attacker to compromise your system.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .