Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [sub-domain]

The domain name system tree structure or DNS hierarchy has a root domain at the top and all the child nodes in the tree are called sub-domains.

Filter by
Sorted by
Tagged with
1 vote
1 answer
353 views

Unknown host on Burp Suite when trying to access *.localhost

I am trying to analyze HTTP traffic of our application. Application has two accessible portals, one accessible by admin.localhost:3002 and the other accessible by localhost:3002 I have Burp Suite ...
Gonzalo Aguado Torres's user avatar
0 votes
0 answers
70 views

Subdomain vs Virtual Path discovery by bots

I have a website with a URL of lets say "123.example.com" where I am hosting a large ERP system. Does hosting the application at "123.example.com/myapp" provide any layer of ...
Freeman Helmuth's user avatar
0 votes
0 answers
17 views

efficient subdomain extraction [duplicate]

I am wondering how we can effectively extract all subdomains of given website? For example, the free hosting websites, I would like to extract all subdomains and see if I can find some subdomains ...
glovescoffee's user avatar
9 votes
2 answers
3k views

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? If not does that mean an expensive wildcard SSL certificate will need to be used with these domains? So ...
JamesWeir's user avatar
1 vote
2 answers
238 views

Are there any security reasons against "drop-www" (using example.com instead of www.example.com)?

Are there any security reasons against "drop-www"? In other words, are there any security reasons against using an apex [1] domain name such as example.com instead of a subdomain such as www....
adrelanos's user avatar
  • 764
1 vote
0 answers
215 views

Is it possible to enumerate registered eepsite (I2P) subdomains?

Eepsites are similar to Tor's hidden services, but based on the I2P anonymity network. Named eepsites use central registrars like stats.i2p and no.i2p. Each eepsite also has a b32 domain which is a ...
forest's user avatar
  • 66.8k
0 votes
0 answers
2k views

Scan for open ports on subdomain

I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
vargr616's user avatar
1 vote
2 answers
180 views

Why would a company choose to use different SSL providers for different subdomains

Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least ...
Hotblack Desiato's user avatar
2 votes
1 answer
1k views

What are the security issues with setting cookies for subdomains?

Everywhere I look, I only find explanations as to who can set who's cookies and who can access the cookies of whom. Why do we need these restrictions? More precisely: Why is it OK for a subdomain to ...
GalSuchetzky's user avatar
0 votes
1 answer
171 views

How does msnbot keep finding my unpublished admin url?

I am a website developer (mainly using MVC.NET). Recently, we have been contacted by a hacker. He claimed that he knows our admin URL. The problem is we do not publish or put the admin URL anywhere on ...
Sam's user avatar
  • 109
0 votes
1 answer
85 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
schrodingerscatcuriosity's user avatar
0 votes
1 answer
145 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
Offensive Bug Hunter's user avatar
1 vote
3 answers
596 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
Sinatra's user avatar
  • 11
-1 votes
2 answers
424 views

How does DNS-01 validation for LetsEncrypt know what the right IP address is?

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
SILENT's user avatar
  • 166
3 votes
1 answer
468 views

Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?

I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia. On the subject of DNS cache poisoning, they mention that a "...
Stefan van den Akker's user avatar
1 vote
0 answers
149 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
Stacky's user avatar
  • 11
1 vote
0 answers
318 views

Phishing/spam websites using the same domain as legitimate websites?

I have found links to an obvious bait website. Link to PHISHING website. However, I was very surprised to see the domain is "holidayinn.com". On first sight this appears to be a genuine ...
username193228's user avatar
0 votes
2 answers
2k views

Can subdomains of trusted domains be registered for malicious use?

I was working on a rule that reports phishing sites, and I wanted to exclude known domains, such as .microsoft.com etc, and a doubt arose: can someone register a subdomain of a known site to phishing ...
Pleasant94's user avatar
0 votes
1 answer
226 views

Can attack to a website from a parked subdomain with different hosts?

I have a website like maindomain.com that is hosted on one IP address like 192.168.1.1. I want to add a subdomain from a different host (such as 192.168.1.2) to my root domain (maindomain.com), such ...
Mister X's user avatar
  • 101
1 vote
1 answer
2k views

Cookie domain security

Recently, I started diving into cookies, but as far as the domain property is concerned I don't think it is straightforward. I read this article: http://web.archive.org/web/20200418163316/https://www....
Maikkeyy's user avatar
  • 217
4 votes
2 answers
1k views

Can random subdomain naming enhance security?

I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
Navjot Singh's user avatar
0 votes
0 answers
32 views

Are there any risks selling subdomains? [duplicate]

I am considering buying a nice domain name (say example.com) and would be interested in reselling subdomains (e.g. chris.example.com) to third parties (or close friends). I would give them full ...
Chris Smith's user avatar
0 votes
1 answer
1k views

nmap: Same IP, different domain names, different results?

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
ChocolateOverflow's user avatar
3 votes
1 answer
763 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
Hauleth's user avatar
  • 133
1 vote
2 answers
423 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
sahil's user avatar
  • 111
0 votes
1 answer
454 views

can an attacker exploit my main site from subdomain?

I have an app that was in a folder on my main site's root directory www.example.com/app which was recently hacked and the entire website was offline because the server load was too high and the ...
Sergiu Elmi's user avatar
3 votes
0 answers
253 views

Is it possible to exploit this cors?

I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
new liyuser's user avatar
0 votes
0 answers
150 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
stack ups's user avatar
2 votes
1 answer
1k views

How do partial wildcards in subjectAltName dNSName interact with IDNA domains?

For instance if I run IDNA encode bücher.tld you receive xn--bcher-kva.tld. Now imagine the certificate for https://bücher.tld has the following field within subjectAltName: (dNSName, xn--bcher*.tld). ...
Seth Larson's user avatar
0 votes
1 answer
1k views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
Anas Ahmed Khan Niazi's user avatar
-1 votes
1 answer
611 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
John Doe's user avatar
0 votes
1 answer
2k views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
Anant Bhandarkar's user avatar
1 vote
0 answers
613 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
Jyosk Natalm's user avatar
1 vote
2 answers
499 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
Nick W's user avatar
  • 111
-1 votes
1 answer
155 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
Jeroen's user avatar
  • 111
1 vote
1 answer
780 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
Azaam Alfi's user avatar
1 vote
1 answer
825 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
hd.'s user avatar
  • 158
6 votes
3 answers
3k views

Setting up LetsEncrypt SSL for domains/subdomains on two servers

LetsEncrypt certificates have been created for example.com and www.example.com. This is a Linux server on IP 123.123.123.1. I would like to add foo.example.com and bar.example.com, but these ...
Fid's user avatar
  • 171
0 votes
1 answer
3k views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
PJ7's user avatar
  • 125
2 votes
1 answer
354 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
progress44's user avatar
1 vote
1 answer
329 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
oBreak's user avatar
  • 470
4 votes
1 answer
1k views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
CAP STEEZ's user avatar
2 votes
2 answers
313 views

Why one may want to get different certificates for different subdomains?

I know there are some tricks to play with wildcards to make a certificate to be valid for all the subdomains ( such as here), but my question is what is the design reason that certificates can be ...
Alex's user avatar
  • 123
0 votes
1 answer
179 views

Can I send/receive HTTP requests/responses with a subdomain on a crossdomain.xml file?

(I'll use website.com in place of the actual domain as to not disclose any specific website vulnerability) I noticed on a website that their crossdomain.xml file allowed access from another website ...
Jack's user avatar
  • 501
0 votes
1 answer
1k views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
Jenny B's user avatar
  • 41
4 votes
1 answer
413 views

What can I do with crossdomain.xml access to a website

I've been learning more about subdomain takeovers and trying to find other risks of them. I have a fairly simple question; what can you do with access to a website via a crossdomain.xml file? (ex. ...
Jack's user avatar
  • 501
5 votes
1 answer
300 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
Tim Perry's user avatar
  • 181
5 votes
1 answer
2k views

Subdomains - Security Risk?

I have just checked and found that I have a number of subdomains live that re-direct to sites which I don't recognise. Is it possible for a 3rd party to own a sub-domain of my site? From a ...
John's user avatar
  • 51
6 votes
3 answers
1k views

Any threats from isolated subdomain (controlled by hacker)?

I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
T.Todua's user avatar
  • 2,727
1 vote
1 answer
2k views

Subdomain Takeover

I'm familiar with subdomain takeover when the following is the situation: a.site.com CNAME site.mktoweb.com If site.mktoweb.com isn't registered then you can create an account on Heroku and ...
megmay's user avatar
  • 21