47 votes
Accepted

HSTS on a subdomain with includeSubdomains

Based on the RFC, HTTP Strict Transport Security (HSTS), the includeSubDomains states: 6.1.2. The includeSubDomains Directive The OPTIONAL "includeSubDomains" directive is a valueless ...
user avatar
  • 1,802
22 votes
Accepted

Double Submit Cookies vulnerabilities

According to a paper published in Blackhat 2013, it isn't enough for you to implement Double-Submit Cookies in its own sub-domain (e.g. secure.host.com). You really must control all sub-domains: 2.1....
user avatar
  • 2,149
21 votes

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

Subdomains can often be used for different purposes, and as a result they can be using different web applications possibly hosted on different equipment. Not every website on every subdomain needs ...
user avatar
  • 6,778
17 votes

What is the purpose of subdomain enumeration?

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about ...
user avatar
16 votes

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

It's best to let the site owner decide whether subdomains are affected, just as the site owner decides whether to use HSTS at all. The extra flexibility could help improve HSTS adoption by reducing ...
user avatar
  • 13.8k
12 votes
Accepted

Any threats from isolated subdomain (controlled by hacker)?

Based on the few details of this setup and some guess work what you might use this setup for the following problems come to mind: with local privilege escalation exploit one might break out of the ...
user avatar
10 votes

What is the purpose of subdomain enumeration?

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point ...
user avatar
  • 7,275
9 votes

Double Submit Cookies vulnerabilities

Although all XSS attacks trump CSRF protections, these require differing effort from the attacker. A simple protection such as a token is easy for an attacker to get via an XSS attack, as they can ...
user avatar
9 votes

How can I find subdomains of a site?

1. Zone transfer Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack. Tools for zone ...
user avatar
  • 31.8k
6 votes

Any threats from isolated subdomain (controlled by hacker)?

Yes. Although we don't know all the details about the OS you are using or about the different software's you use the potential attack is a Privilege Escalation that can be done. The attacker (in ...
user avatar
5 votes
Accepted

Is it safe to point a (sub)domain to my home IP address?

The real risk is having incoming access to your home network at all. The fact that it is accessible through DNS does not significantly add to the risk. The "bad guys" find open ports through port ...
user avatar
  • 5,270
5 votes
Accepted

Why one may want to get different certificates for different subdomains?

There a few cases for this: Compromised hosts, say you have a company, company.xyz, a wildcard and have a few machines on there; blog.company.xyz, www.company.xyz, mail.company.xyz, vpn.company.xyz. ...
user avatar
  • 3,146
5 votes
Accepted

Wildcard certificate generated for local CA do not work for the subdomains

The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used. This function ...
user avatar
5 votes
Accepted

Can random subdomain naming enhance security?

You should assume that an attacker can observe traffic. This may happen at your network endpoint, at the client's end, or somewhere in between. On the client side, the attacker will see DNS ...
user avatar
  • 3,812
4 votes

How could you find wildcard subdomains on websites?

In this answer, you can detect from DNS if they have a wildcard domain, this will save you time (and you won't have HTTP queries to the domain) Taken from the serverfault post: # dig +short '*.not-a-...
user avatar
  • 3,146
4 votes

SSL Cert for sub.domain.com and www.sub.domain.com

A wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. Depending on the number of subdomains an advantage could be that it saves money and also ...
user avatar
  • 1,040
4 votes
Accepted

Wildcard SSL and EV SSL

Yes, this is possible. When the www or root domain are accessed, the users will see the green bar in the browser, since those sites will be returning the EV certificate. When a user loads a page ...
user avatar
  • 35.4k
4 votes
Accepted

Is there a difference in security between an IP address white list and a domain white list with TLS?

tl;dr: different things, both useful for different scenarios, IP whitelisting is not a bad sign You are indeed comparing apples and oranges. IP-based filtering happens at the network layer of the ...
user avatar
  • 14.3k
4 votes

Are there still some ssl domains containing the nul character for testing purposes?

There is no such thing as an "SSL domain". There is no NUL-handling bug in SSL, which is a specification. Only bugs in implementations. Lots of bugs. In these bugs, there never was a NUL character ...
user avatar
  • 750
4 votes
Accepted

Subdomain Takeover

Subdomains cannot be registered. Domains are registered, and then the designated Nameservers (DNS Servers) are able to control the subdomains. In many cases, the Registrar is also handling ...
user avatar
  • 13.8k
4 votes

Subdomains - Security Risk?

Is it possible for a 3rd party to own a sub-domain of my xxx.com site? No, other folks cannot own register subdomains for a domain which you have already registered. Here's the ownership tree. The ...
user avatar
  • 13.8k
4 votes

Subdomain takeover due to improper records

Snapchat had this Fastly instance set up, but eventually cancelled their service. However, they had forgotten to remove the DNS record, which allowed this researcher to simply to register a new Fastly ...
user avatar
3 votes

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

NO! You have now shared your key with someone you can't trust to keep it safe. YES! This way if their key gets compromised or your key gets compromised, the other key is safe, and so are those systems/...
user avatar
3 votes

SSL Cert for sub.domain.com and www.sub.domain.com

Wildcard SSL protects the unlimited numbers of subdomains in the terms of all are created on your main domain name. When Wildcard SSL certificate issued for *.domain.com, that can secure… sub1....
user avatar
3 votes

Security implications of providing users subdomains on my domain?

Yes, they could poison cookies on your domain to execute say a Session Fixation attack. e.g. The attacker visits your main website www.example.com and gets a session ID. The attacker adds some ...
user avatar
3 votes

How can I find subdomains of a site?

Jason Haddix wrote my favorite subdomain/hostname discovery tool that depends on a very-recent version of recon-ng -- available here -- https://github.com/jhaddix/domain subbrute is decent, fierce -...
user avatar
  • 18.9k
3 votes
Accepted

How could you find wildcard subdomains on websites?

The first answer doesn't technically answer the question. Official Method There's only one official method of doing this using the dig command: dig @ns.thenameserver.net example.com axfr AXFR is a ...
user avatar
3 votes

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

Yes, this should apply to all subdomains (see Steffen Ullrich's comment for caveat). In foo.bar.foobar, foo is a subdomain of bar.foobar, and bar is a subdomain of foobar, so therefore foo.bar.foobar ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible