Questions tagged [domain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
35 views

How to stop/reduce constant DNS Spoof/Poisoning Attack from NGINX server if DNSSEC is not offered from provider?

Currently my domain is sitting without DNSSEC security because my domain provider didnt support it for my ccTLD domain, the feature will only be available once i renew my domain in about 2 months time....
user avatar
0 votes
1 answer
116 views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
user avatar
0 votes
1 answer
52 views

How to get my exploit script served on arbitrary subdomain?

Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the ...
user avatar
  • 28.5k
0 votes
1 answer
87 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
user avatar
1 vote
0 answers
278 views

Looking for origin/ verification of malicious domain names [closed]

My network sniffer for websites has discovered a number of hosting domains in the report which I can not correctly assign to categories. I don't know if there are providers behind these domains that ...
user avatar
  • 11
0 votes
0 answers
176 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
user avatar
0 votes
0 answers
76 views

What are the security risks when doing domain migration of users and computers?

We are moving users and computers/servers from an old domain to a new one within our company. The domains are managed using Active Directory. What are the security risks, considerations, and controls ...
user avatar
0 votes
3 answers
183 views

Should I have another domain name for my company internal tools

My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...
user avatar
  • 775
-1 votes
2 answers
199 views

How does DNS-01 validation for LetsEncrypt know what the right IP address is?

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
user avatar
  • 166
-1 votes
1 answer
82 views

Are purchased domains from third party registers or hosting managers without Cpanels or VPS or Editable Pages hackable?

If someone buys a domain and one may type the url in but just sees a template page from the register.com but doesn’t purchase a cpanel or VPS or rootacess or any way to edit the website, does the ...
user avatar
  • 109
0 votes
1 answer
217 views

Should I use my own domain in my proton mail?

Using my own domain on Proton Mail is cool, but what if someone hack my namecheap account? What if some government orders that my domain is redirected? Should I use @protonmail instead of @mydomain? ...
user avatar
1 vote
1 answer
78 views

Is unrestricted query access to dedicated DNS server considered an insecurity?

Let's say hypothetically a business has a network and some respective infrastructure. Importantly, a VPN for giving remote secure access to work resources, and a (not so)private DNS server for DNS but ...
user avatar
0 votes
1 answer
120 views

Realistic for organizations to avoid links in emails pointing to less known sites?

Over the years, I found myself constantly pointing out to organizations that emails containing links with 3rd party domain names that are relatively unknown are problematic. That's how social ...
user avatar
2 votes
1 answer
112 views

Email "FROM address" is changed to an unexpected email address

I have enabled DMARC settings in my domain (drkotzi.org). Now when I send emails from my email address (sales@drkotzi.org) to email lists or email groups, I can see that the email's from address and ...
user avatar
0 votes
0 answers
95 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
user avatar
  • 21
1 vote
1 answer
162 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
user avatar
  • 13
0 votes
1 answer
127 views

a single ip adress host multiple domain at the same time, how do i scan it using nmap or other tools?

lets say an ip adress 111.111.111.111 host multiple domain, (example.com , exampleid.com , admin.example.com, etc.) and i wanted to scan it port, how do i scan a spesific domain (headers key: Host ...
user avatar
0 votes
2 answers
97 views

allowing users to add custom html/js code and show it only under another domain

I have a web app where I allow users to create a one-page portfolio using drag and drop, also I allow them to add custom HTML freely (basically any html or js code) I'm aware that I shouldn't allow ...
user avatar
  • 129
0 votes
1 answer
108 views

Is an IP not being redirected to it's associated domain considered unsecure?

I've got a server that has domain and an SSL Certificate issued to that domain. It's expected behavior that when an IP address is browsed, it redirects to the domain name of the server and the SSL ...
user avatar
  • 23
0 votes
1 answer
89 views

.local domain any possible ways in getting the extension

I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host. ...
user avatar
1 vote
1 answer
192 views

Is it possible for a domain to be faked?

I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
user avatar
  • 562
0 votes
1 answer
132 views

What is the list of known host domains where subdomains come from different providers?

I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do ...
user avatar
2 votes
1 answer
530 views

how can I find all the websites on a particular IP? [duplicate]

When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same ...
user avatar
  • 23
1 vote
1 answer
154 views

Protecting a website from being kidnapped

I have a MediaWiki website in Hebrew; As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible. I chose to give that website a Global TLD (a non ...
user avatar
  • 11
3 votes
2 answers
1k views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
user avatar
  • 175
0 votes
1 answer
546 views

Why can I still receive email at my old domain after someone else bought it?

My domain expired years ago and was registered by another party. I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes. Now if someone buys ...
user avatar
0 votes
1 answer
388 views

Cookie domain security

Recently, I started diving into cookies, but as far as the domain property concerned I don't experience it as too be that straightforward. I've read this article: http://web.archive.org/web/...
user avatar
  • 187
0 votes
1 answer
135 views

Point domain to IP address on Cobalt Strike [closed]

On Cobalt Strike how do I point a domain (in this case a subdomain) to the IP address to create a listener?
user avatar
1 vote
0 answers
56 views

How the information from different resources are used in calculating the reputation score of a domain name in whoisxml (domain reputation API)?

I'm trying to obtain the reputation score of a domain name from whoisxml. There are some resources listed in their website such as the website content and it relation to other domains, and host ...
user avatar
  • 11
1 vote
1 answer
296 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
user avatar
0 votes
0 answers
117 views

Risks associated with developers using their own domain for development services

We have some development and test environments using our canonical domain, e.g. dev.example.com. We also use some services from 3rd party providers that have obscure URLs like xjkhasdkjvhas.dns.ashdfb....
user avatar
  • 1
0 votes
0 answers
30 views

Is one top level domain more inherently secure than another? [duplicate]

There's an interesting discussion going on at work right now. Someone wants to move their app off a .com domain and put it on a .net domain. They contend a .net domain can provide the level of ...
user avatar
  • 185
2 votes
0 answers
209 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
user avatar
1 vote
1 answer
166 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
user avatar
  • 133
1 vote
1 answer
218 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
user avatar
  • 113
0 votes
1 answer
139 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
user avatar
  • 3
3 votes
4 answers
431 views

Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth ...
user avatar
  • 432
0 votes
1 answer
86 views

One domain using certificate of other domain [closed]

I recently Googled a website e.g A.com and found B.com in search result at the top. In reality A.com should be on top as B.com doesn't have anything in common or related to A.com but Google shows it ...
user avatar
  • 3
0 votes
1 answer
133 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
user avatar
  • 25
0 votes
2 answers
311 views

how one can find out sub-domains of a domain without brute-force?

I had to edit my original question after several answers were submitted. Original question was: how one can find out sub-domains of a domain without brute-force? is there a way to request a domain ...
user avatar
0 votes
2 answers
240 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
user avatar
  • 157
102 votes
8 answers
25k views

Can someone read my E-Mail if I lose ownership of my domain?

Let's assume I have a server set up with an email address like me@mydomain.tld. Now I have distributed my business card with the e-mail address to all people all over the world and they keep sending ...
user avatar
2 votes
2 answers
356 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
user avatar
  • 121
1 vote
0 answers
117 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
user avatar
1 vote
1 answer
138 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
user avatar
  • 670
-1 votes
1 answer
80 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
user avatar
0 votes
1 answer
468 views

Benign, Malicious Domains and Definitions

I am working on a research project where we segregate domains used for malicious purpose from benign domains. However, my guide does not want the term malicious domain and benign domain in the paper....
user avatar
  • 193
0 votes
3 answers
346 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
user avatar
  • 237
1 vote
0 answers
308 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
user avatar
2 votes
2 answers
142 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
user avatar