Questions tagged [domain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1
votes
0answers
20 views

Having two TLS certificate on the same domain endpoint [closed]

According to this question, it seems to be not technically doable for having two TLS certificates on the same domain. I have been analysing facebook.com domain using an online tool here, and I can see ...
0
votes
1answer
40 views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
0
votes
1answer
42 views

How to get my exploit script served on arbitrary subdomain?

Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the ...
0
votes
1answer
188 views

Should I use my own domain in my proton mail?

Using my own domain on Proton Mail is cool, but what if someone hack my namecheap account? What if some government orders that my domain is redirected? Should I use @protonmail instead of @mydomain? ...
0
votes
1answer
75 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
1
vote
0answers
192 views

Looking for origin/ verification of malicious domain names [closed]

My network sniffer for websites has discovered a number of hosting domains in the report which I can not correctly assign to categories. I don't know if there are providers behind these domains that ...
0
votes
0answers
156 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
1answer
205 views

How to separate and secure domains using cPanel?

When you add a new domain in some hostings (i.e. 000webhost or some other hostings, which DOESNT USE cPanel) an entirely separate public_html is created (with a separate FTP login and etc..). But ...
0
votes
0answers
63 views

What are the security risks when doing domain migration of users and computers?

We are moving users and computers/servers from an old domain to a new one within our company. The domains are managed using Active Directory. What are the security risks, considerations, and controls ...
0
votes
3answers
133 views

Should I have another domain name for my company internal tools

My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...
-1
votes
2answers
180 views

How does DNS-01 validation for LetsEncrypt know what the right IP address is?

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
-1
votes
1answer
78 views

Are purchased domains from third party registers or hosting managers without Cpanels or VPS or Editable Pages hackable?

If someone buys a domain and one may type the url in but just sees a template page from the register.com but doesn’t purchase a cpanel or VPS or rootacess or any way to edit the website, does the ...
0
votes
1answer
320 views

Cookie domain security

Recently, I started diving into cookies, but as far as the domain property concerned I don't experience it as too be that straightforward. I've read this article: http://web.archive.org/web/...
1
vote
1answer
71 views

Is unrestricted query access to dedicated DNS server considered an insecurity?

Let's say hypothetically a business has a network and some respective infrastructure. Importantly, a VPN for giving remote secure access to work resources, and a (not so)private DNS server for DNS but ...
8
votes
4answers
12k views

A security warning when accessing a site through IP

When I go to https://www.schneier.com/, everything works normal. As soon as I access the same site using its IP address (66.33.204.254), I get a security warning (even if I write something like https:...
0
votes
1answer
112 views

Realistic for organizations to avoid links in emails pointing to less known sites?

Over the years, I found myself constantly pointing out to organizations that emails containing links with 3rd party domain names that are relatively unknown are problematic. That's how social ...
2
votes
1answer
107 views

Email "FROM address" is changed to an unexpected email address

I have enabled DMARC settings in my domain (drkotzi.org). Now when I send emails from my email address (sales@drkotzi.org) to email lists or email groups, I can see that the email's from address and ...
0
votes
0answers
83 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
1
vote
1answer
148 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
0
votes
1answer
114 views

a single ip adress host multiple domain at the same time, how do i scan it using nmap or other tools?

lets say an ip adress 111.111.111.111 host multiple domain, (example.com , exampleid.com , admin.example.com, etc.) and i wanted to scan it port, how do i scan a spesific domain (headers key: Host ...
0
votes
2answers
86 views

allowing users to add custom html/js code and show it only under another domain

I have a web app where I allow users to create a one-page portfolio using drag and drop, also I allow them to add custom HTML freely (basically any html or js code) I'm aware that I shouldn't allow ...
1
vote
1answer
187 views

Is it possible for a domain to be faked?

I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
0
votes
1answer
101 views

Is an IP not being redirected to it's associated domain considered unsecure?

I've got a server that has domain and an SSL Certificate issued to that domain. It's expected behavior that when an IP address is browsed, it redirects to the domain name of the server and the SSL ...
0
votes
1answer
83 views

.local domain any possible ways in getting the extension

I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host. ...
2
votes
2answers
347 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
0
votes
1answer
122 views

What is the list of known host domains where subdomains come from different providers?

I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do ...
2
votes
1answer
438 views

how can I find all the websites on a particular IP? [duplicate]

When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same ...
3
votes
3answers
8k views

How to make sure an API request is coming from a specific domain?

I'm opening up some API access to my site and my users are required to specify from which of their websites, such as example.com, they will make the API requests. I'm wondering if there's any way to ...
1
vote
1answer
149 views

Protecting a website from being kidnapped

I have a MediaWiki website in Hebrew; As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible. I chose to give that website a Global TLD (a non ...
3
votes
2answers
984 views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
0
votes
1answer
436 views

Why can I still receive email at my old domain after someone else bought it?

My domain expired years ago and was registered by another party. I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes. Now if someone buys ...
0
votes
1answer
121 views

Point domain to IP address on Cobalt Strike [closed]

On Cobalt Strike how do I point a domain (in this case a subdomain) to the IP address to create a listener?
1
vote
0answers
51 views

How the information from different resources are used in calculating the reputation score of a domain name in whoisxml (domain reputation API)?

I'm trying to obtain the reputation score of a domain name from whoisxml. There are some resources listed in their website such as the website content and it relation to other domains, and host ...
1
vote
2answers
217 views

Spoofing domain registration date info

Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?
1
vote
1answer
267 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
0
votes
0answers
111 views

Risks associated with developers using their own domain for development services

We have some development and test environments using our canonical domain, e.g. dev.example.com. We also use some services from 3rd party providers that have obscure URLs like xjkhasdkjvhas.dns.ashdfb....
0
votes
0answers
30 views

Is one top level domain more inherently secure than another? [duplicate]

There's an interesting discussion going on at work right now. Someone wants to move their app off a .com domain and put it on a .net domain. They contend a .net domain can provide the level of ...
2
votes
0answers
198 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
1
vote
1answer
159 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
1answer
206 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
0
votes
1answer
132 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
3
votes
3answers
5k views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
3
votes
4answers
424 views

Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth ...
0
votes
1answer
236 views

Domain SSL encryption from client to DNS Server

Im wondering why the domain name is not encrypted when a request do a DNS Server is made. As it seems this is the main weaknesses for internet users. I came to this when i heard that in germany ...
0
votes
1answer
84 views

One domain using certificate of other domain [closed]

I recently Googled a website e.g A.com and found B.com in search result at the top. In reality A.com should be on top as B.com doesn't have anything in common or related to A.com but Google shows it ...
0
votes
1answer
123 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
0
votes
2answers
276 views

how one can find out sub-domains of a domain without brute-force?

I had to edit my original question after several answers were submitted. Original question was: how one can find out sub-domains of a domain without brute-force? is there a way to request a domain ...
0
votes
2answers
209 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
0
votes
3answers
4k views

Is it possible to get Network Domain from Client with PHP or Apache? [closed]

I'm working on a solution to identify client Network Domain or Workgroup in a private network. Based on it, I must change some access permissions. I can't do that through IP address because it isn't ...
101
votes
8answers
25k views

Can someone read my E-Mail if I lose ownership of my domain?

Let's assume I have a server set up with an email address like me@mydomain.tld. Now I have distributed my business card with the e-mail address to all people all over the world and they keep sending ...