Questions tagged [sub-domain]
The domain name system tree structure or DNS hierarchy has a root domain at the top and all the child nodes in the tree are called sub-domains.
75
questions
0
votes
0
answers
27
views
Subdomain vs Virtual Path discovery by bots
I have a website with a URL of lets say "123.example.com" where I am hosting a large ERP system. Does hosting the application at "123.example.com/myapp" provide any layer of ...
0
votes
0
answers
17
views
efficient subdomain extraction [duplicate]
I am wondering how we can effectively extract all subdomains of given website? For example, the free hosting websites, I would like to extract all subdomains and see if I can find some subdomains ...
9
votes
2
answers
3k
views
Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?
Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? If not does that mean an expensive wildcard SSL certificate will need to be used with these domains?
So ...
- 91
0
votes
0
answers
22
views
what is a subdomain dump and is it dangerous? [duplicate]
I found this subdomain dump or whatever this of pipedrive website on ghostbin. I was wondering what threat this poses to the organisation and what can be done if anything to mitigate the threat.
••...
- 1
1
vote
2
answers
188
views
Are there any security reasons against "drop-www" (using example.com instead of www.example.com)?
Are there any security reasons against "drop-www"?
In other words, are there any security reasons against using an apex [1] domain name such as example.com instead of a subdomain such as www....
- 744
1
vote
0
answers
150
views
Is it possible to enumerate registered eepsite (I2P) subdomains?
Eepsites are similar to Tor's hidden services, but based on the I2P anonymity network.
Named eepsites use central registrars like stats.i2p and no.i2p. Each eepsite also has a b32 domain which is a ...
- 66.5k
0
votes
0
answers
1k
views
Scan for open ports on subdomain
I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
- 1
1
vote
2
answers
127
views
Why would a company choose to use different SSL providers for different subdomains
Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least ...
2
votes
1
answer
819
views
What are the security issues with setting cookies for subdomains?
Everywhere I look, I only find explanations as to who can set who's cookies and who can access the cookies of whom.
Why do we need these restrictions?
More precisely:
Why is it OK for a subdomain to ...
- 133
0
votes
1
answer
138
views
How does msnbot keep finding my unpublished admin url?
I am a website developer (mainly using MVC.NET). Recently, we have been contacted by a hacker. He claimed that he knows our admin URL. The problem is we do not publish or put the admin URL anywhere on ...
- 109
0
votes
1
answer
52
views
Prevent client access being the same as admin access in web application
My colleagues and I are developing a public web application with client and admin access.
I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0
votes
1
answer
115
views
Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?
I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
1
vote
3
answers
455
views
Port scanning against assets that are behind a WAF
I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
- 11
-1
votes
2
answers
365
views
How does DNS-01 validation for LetsEncrypt know what the right IP address is?
For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
- 166
3
votes
1
answer
417
views
Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?
I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia.
On the subject of DNS cache poisoning, they mention that a "...
1
vote
0
answers
120
views
Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]
I don't have much experience in buying and installing ssl certificates.
I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
- 11
1
vote
0
answers
264
views
Phishing/spam websites using the same domain as legitimate websites?
I have found links to an obvious bait website. Link to PHISHING website. However, I was very surprised to see the domain is "holidayinn.com". On first sight this appears to be a genuine ...
0
votes
2
answers
2k
views
Can subdomains of trusted domains be registered for malicious use?
I was working on a rule that reports phishing sites, and I wanted to exclude known domains, such as .microsoft.com etc, and a doubt arose: can someone register a subdomain of a known site to phishing ...
- 103
0
votes
1
answer
196
views
Can attack to a website from a parked subdomain with different hosts?
I have a website like maindomain.com that is hosted on one IP address like 192.168.1.1. I want to add a subdomain from a different host (such as 192.168.1.2) to my root domain (maindomain.com), such ...
- 101
0
votes
1
answer
1k
views
Cookie domain security
Recently, I started diving into cookies, but as far as the domain property is concerned I don't think it is straightforward.
I read this article:
http://web.archive.org/web/20200418163316/https://www....
- 187
4
votes
2
answers
1k
views
Can random subdomain naming enhance security?
I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
- 143
0
votes
0
answers
32
views
Are there any risks selling subdomains? [duplicate]
I am considering buying a nice domain name (say example.com) and would be interested in reselling subdomains (e.g. chris.example.com) to third parties (or close friends). I would give them full ...
- 222
0
votes
1
answer
1k
views
nmap: Same IP, different domain names, different results?
I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
- 3,482
3
votes
1
answer
726
views
Wildcard certificate generated for local CA do not work for the subdomains
I have created Makefile to simplify generation certificates for local development:
DOMAIN ?= localhost
NAME ?= ${DOMAIN}
CAKEY ?= CAkey.key
CACERT ?= CAcert.pem
SIGN_REQ ?= ${NAME}.csr
...
- 133
1
vote
2
answers
378
views
Are subdomains secure from one another if they are on separate servers?
I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com).
Each user application will be run on separate servers ...
- 111
0
votes
1
answer
390
views
can an attacker exploit my main site from subdomain?
I have an app that was in a folder on my main site's root directory www.example.com/app which was recently hacked and the entire website was offline because the server load was too high and the ...
- 103
3
votes
0
answers
228
views
Is it possible to exploit this cors?
I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
- 41
0
votes
0
answers
127
views
Is it possible to extract data from api response from main domain?
I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz?
The xss is on subdomain.example.com and I'd ...
- 19
2
votes
1
answer
1k
views
How do partial wildcards in subjectAltName dNSName interact with IDNA domains?
For instance if I run IDNA encode bücher.tld you receive xn--bcher-kva.tld. Now imagine the certificate for https://bücher.tld has the following field within subjectAltName: (dNSName, xn--bcher*.tld).
...
- 21
0
votes
1
answer
1k
views
setting up ssl for cname only subdomain [closed]
I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have.
I've a domain, say abc.com, which is live with ssl on ...
-1
votes
1
answer
557
views
Subdomain scanner without brute-force attack? [duplicate]
It is possible to scan subdomains of network without brute-force attack?
If yes, how it works?
I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
- 1
0
votes
1
answer
2k
views
Subdomain Scan protection
I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster.
What is the best way to protect subdomains of any website from getting scanned or revealed via ...
- 101
1
vote
0
answers
574
views
Is subdomain takeover possible in this case?
I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME >
xyz.example.com.ent.syn-alias.com (same 404 page)
Which is pointing to another ...
- 71
1
vote
2
answers
457
views
Cross subdomain PHP security?
I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security?
If a user with subdomain FTP ...
- 111
-2
votes
1
answer
134
views
How to check hosted content for fraud?
I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
- 101
1
vote
1
answer
721
views
How can I determine the vulnerability for a sub domain takeover attack?
I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
- 23
1
vote
1
answer
774
views
What is this phishing technique called using subdomains
I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
- 158
6
votes
3
answers
3k
views
Setting up LetsEncrypt SSL for domains/subdomains on two servers
LetsEncrypt certificates have been created for example.com and www.example.com. This is a Linux server on IP 123.123.123.1.
I would like to add foo.example.com and bar.example.com, but these ...
- 171
0
votes
1
answer
3k
views
how block all subdomains for a particular domain
I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
- 125
1
vote
1
answer
325
views
Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?
I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
- 13
1
vote
1
answer
297
views
My company is considering collapsing from multiple independent domains to one trust network
Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
- 470
4
votes
1
answer
1k
views
Subdomain takeover due to improper records
INTRO
On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too.
QUESTION
I found a snapchat (sc-cdn.net) ...
- 41
2
votes
2
answers
279
views
Why one may want to get different certificates for different subdomains?
I know there are some tricks to play with wildcards to make a certificate to be valid for all the subdomains ( such as here), but my question is what is the design reason that certificates can be ...
- 123
0
votes
1
answer
157
views
Can I send/receive HTTP requests/responses with a subdomain on a crossdomain.xml file?
(I'll use website.com in place of the actual domain as to not disclose any specific website vulnerability)
I noticed on a website that their crossdomain.xml file allowed access from another website ...
- 481
0
votes
1
answer
933
views
how to do internal subdomain enumerations in corp network?
I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
- 41
4
votes
1
answer
387
views
What can I do with crossdomain.xml access to a website
I've been learning more about subdomain takeovers and trying to find other risks of them.
I have a fairly simple question; what can you do with access to a website via a crossdomain.xml file?
(ex. ...
- 481
5
votes
1
answer
267
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 181
5
votes
1
answer
2k
views
Subdomains - Security Risk?
I have just checked and found that I have a number of subdomains live that re-direct to sites which I don't recognise.
Is it possible for a 3rd party to own a sub-domain of my site?
From a ...
- 51
6
votes
3
answers
1k
views
Any threats from isolated subdomain (controlled by hacker)?
I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
- 2,727
1
vote
1
answer
2k
views
Subdomain Takeover
I'm familiar with subdomain takeover when the following is the situation:
a.site.com CNAME site.mktoweb.com
If site.mktoweb.com isn't registered then you can create an account on Heroku and ...
- 21