Questions tagged [sub-domain]

The domain name system tree structure or DNS hierarchy has a root domain at the top and all the child nodes in the tree are called sub-domains.

Filter by
Sorted by
Tagged with
0 votes
1 answer
24 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
user avatar
0 votes
1 answer
88 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
user avatar
0 votes
2 answers
137 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
user avatar
-1 votes
2 answers
208 views

How does DNS-01 validation for LetsEncrypt know what the right IP address is?

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
user avatar
  • 166
2 votes
1 answer
224 views

Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?

I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia. On the subject of DNS cache poisoning, they mention that a "...
user avatar
1 vote
0 answers
85 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
user avatar
  • 11
1 vote
0 answers
152 views

Phishing/spam websites using the same domain as legitimate websites?

I have found links to an obvious bait website. Link to PHISHING website. However, I was very surprised to see the domain is "holidayinn.com". On first sight this appears to be a genuine ...
user avatar
0 votes
2 answers
436 views

Can subdomains of trusted domains be registered for malicious use?

I was working on a rule that reports phishing sites, and I wanted to exclude known domains, such as .microsoft.com etc, and a doubt arose: can someone register a subdomain of a known site to phishing ...
user avatar
0 votes
1 answer
152 views

Can attack to a website from a parked subdomain with different hosts?

I have a website like maindomain.com that is hosted on one IP address like 192.168.1.1. I want to add a subdomain from a different host (such as 192.168.1.2) to my root domain (maindomain.com), such ...
user avatar
  • 101
0 votes
1 answer
431 views

Cookie domain security

Recently, I started diving into cookies, but as far as the domain property concerned I don't experience it as too be that straightforward. I've read this article: http://web.archive.org/web/...
user avatar
  • 187
4 votes
2 answers
603 views

Can random subdomain naming enhance security?

I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
user avatar
0 votes
0 answers
30 views

Are there any risks selling subdomains? [duplicate]

I am considering buying a nice domain name (say example.com) and would be interested in reselling subdomains (e.g. chris.example.com) to third parties (or close friends). I would give them full ...
user avatar
0 votes
1 answer
746 views

nmap: Same IP, different domain names, different results?

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
user avatar
3 votes
1 answer
608 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
user avatar
  • 133
1 vote
2 answers
273 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
user avatar
  • 111
0 votes
1 answer
280 views

can an attacker exploit my main site from subdomain?

I have an app that was in a folder on my main site's root directory www.example.com/app which was recently hacked and the entire website was offline because the server load was too high and the ...
user avatar
3 votes
0 answers
153 views

Is it possible to exploit this cors?

I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
user avatar
0 votes
0 answers
96 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
user avatar
2 votes
1 answer
717 views

How do partial wildcards in subjectAltName dNSName interact with IDNA domains?

For instance if I run IDNA encode bücher.tld you receive xn--bcher-kva.tld. Now imagine the certificate for https://bücher.tld has the following field within subjectAltName: (dNSName, xn--bcher*.tld). ...
user avatar
0 votes
1 answer
816 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
user avatar
-1 votes
1 answer
416 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
user avatar
0 votes
1 answer
1k views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
user avatar
1 vote
0 answers
448 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
user avatar
1 vote
2 answers
400 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
user avatar
  • 111
-2 votes
1 answer
124 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
user avatar
  • 101
1 vote
1 answer
626 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
user avatar
1 vote
1 answer
647 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
user avatar
  • 158
6 votes
3 answers
3k views

Setting up LetsEncrypt SSL for domains/subdomains on two servers

LetsEncrypt certificates have been created for example.com and www.example.com. This is a Linux server on IP 123.123.123.1. I would like to add foo.example.com and bar.example.com, but these ...
user avatar
  • 161
0 votes
1 answer
2k views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
user avatar
  • 125
1 vote
1 answer
279 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
user avatar
1 vote
1 answer
278 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
user avatar
  • 470
4 votes
1 answer
1k views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
user avatar
2 votes
2 answers
208 views

Why one may want to get different certificates for different subdomains?

I know there are some tricks to play with wildcards to make a certificate to be valid for all the subdomains ( such as here), but my question is what is the design reason that certificates can be ...
user avatar
  • 123
0 votes
1 answer
141 views

Can I send/receive HTTP requests/responses with a subdomain on a crossdomain.xml file?

(I'll use website.com in place of the actual domain as to not disclose any specific website vulnerability) I noticed on a website that their crossdomain.xml file allowed access from another website ...
user avatar
  • 461
0 votes
1 answer
783 views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
user avatar
  • 41
4 votes
1 answer
359 views

What can I do with crossdomain.xml access to a website

I've been learning more about subdomain takeovers and trying to find other risks of them. I have a fairly simple question; what can you do with access to a website via a crossdomain.xml file? (ex. ...
user avatar
  • 461
4 votes
0 answers
225 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
user avatar
  • 151
5 votes
1 answer
2k views

Subdomains - Security Risk?

I have just checked and found that I have a number of subdomains live that re-direct to sites which I don't recognise. Is it possible for a 3rd party to own a sub-domain of my site? From a ...
user avatar
  • 51
6 votes
3 answers
1k views

Any threats from isolated subdomain (controlled by hacker)?

I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
user avatar
  • 2,665
1 vote
1 answer
2k views

Subdomain Takeover

I'm familiar with subdomain takeover when the following is the situation: a.site.com CNAME site.mktoweb.com If site.mktoweb.com isn't registered then you can create an account on Heroku and ...
user avatar
  • 21
2 votes
1 answer
147 views

Are there significant security risks in trusting randomized subdomains to run JS?

This question is similar to Is it safe to whitelist CDN domains?, but is focused on the user's perspective. It seems common in American business websites to use a CDN that presents partially random ...
user avatar
9 votes
3 answers
3k views

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

HSTS restricts the connection to be always HTTPS if deployed by any domain, however for it to be applied to sub-domains the 'includeSubDomain' attribute is needed. Why doesn't the policy itself make ...
user avatar
  • 531
1 vote
1 answer
473 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def....
user avatar
  • 11
4 votes
2 answers
8k views

Is there a difference in security between an IP address white list and a domain white list with TLS?

It seems to me that an IP address white list relies on easily spoofed information, while a domain white list, if it forces TLS, at least, relies on the validity of the certificate systems. I may be ...
user avatar
3 votes
3 answers
5k views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
user avatar
37 votes
4 answers
28k views

HSTS on a subdomain with includeSubdomains

Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS: Strict-Transport-Security: max-age=31536000; includeSubDomains ...
user avatar
0 votes
1 answer
84 views

Subdomain Bruteforcing when every request gets resolved?

Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved? In the case of a subdomain that doesn't exist, the server simply ...
user avatar
  • 41
4 votes
1 answer
541 views

Is Exposing Real IP Through Subdomain A Security Implication?

It seems pretty common for websites to expose their real IP address through subdomains. Many DoS mitigation providers hide your real IP address for the core domain, but leave a subdomain exposed for ...
user avatar
7 votes
2 answers
2k views

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

We are hosting our own secure site with a wildcard certificate. However, we are working with a marketing company that provides landing pages on subdomains of our domain, on ip addresses supplied by ...
user avatar
1 vote
1 answer
227 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
user avatar
  • 1,402