47
votes
Accepted
HSTS on a subdomain with includeSubdomains
Based on the RFC, HTTP Strict Transport Security (HSTS), the includeSubDomains states:
6.1.2. The includeSubDomains Directive
The OPTIONAL "includeSubDomains" directive is a valueless ...
- 1,802
22
votes
Accepted
Double Submit Cookies vulnerabilities
According to a paper published in Blackhat 2013, it isn't enough for you to implement Double-Submit Cookies in its own sub-domain (e.g. secure.host.com). You really must control all sub-domains:
2.1....
- 2,149
21
votes
Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?
Subdomains can often be used for different purposes, and as a result they can be using different web applications possibly hosted on different equipment.
Not every website on every subdomain needs ...
- 6,778
17
votes
What is the purpose of subdomain enumeration?
What's the purpose of that in terms of security / hacking?
The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about ...
- 282
16
votes
Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?
It's best to let the site owner decide whether subdomains are affected, just as the site owner decides whether to use HSTS at all. The extra flexibility could help improve HSTS adoption by reducing ...
- 13.8k
12
votes
Accepted
Any threats from isolated subdomain (controlled by hacker)?
Based on the few details of this setup and some guess work what you might use this setup for the following problems come to mind:
with local privilege escalation exploit one might break out of the ...
- 181k
10
votes
What is the purpose of subdomain enumeration?
Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment.
Enumerating subdomains is crucial as they may point ...
- 7,275
9
votes
Double Submit Cookies vulnerabilities
Although all XSS attacks trump CSRF protections, these require differing effort from the attacker. A simple protection such as a token is easy for an attacker to get via an XSS attack, as they can ...
- 33.2k
9
votes
How can I find subdomains of a site?
1. Zone transfer
Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack.
Tools for zone ...
- 31.8k
6
votes
Any threats from isolated subdomain (controlled by hacker)?
Yes.
Although we don't know all the details about the OS you are using or about the different software's you use the potential attack is a Privilege Escalation that can be done.
The attacker (in ...
- 3,615
5
votes
Accepted
Is it safe to point a (sub)domain to my home IP address?
The real risk is having incoming access to your home network at all. The fact that it is accessible through DNS does not significantly add to the risk. The "bad guys" find open ports through port ...
- 5,270
5
votes
Accepted
Why one may want to get different certificates for different subdomains?
There a few cases for this:
Compromised hosts, say you have a company, company.xyz, a wildcard and have a few machines on there; blog.company.xyz, www.company.xyz, mail.company.xyz, vpn.company.xyz. ...
- 3,146
5
votes
Accepted
Wildcard certificate generated for local CA do not work for the subdomains
The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used.
This function ...
- 181k
5
votes
Accepted
Can random subdomain naming enhance security?
You should assume that an attacker can observe traffic. This may happen at your network endpoint, at the client's end, or somewhere in between.
On the client side, the attacker will see DNS ...
- 3,812
4
votes
How could you find wildcard subdomains on websites?
In this answer, you can detect from DNS if they have a wildcard domain, this will save you time (and you won't have HTTP queries to the domain)
Taken from the serverfault post:
# dig +short '*.not-a-...
- 3,146
4
votes
SSL Cert for sub.domain.com and www.sub.domain.com
A wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. Depending on the number of subdomains an advantage could be that it saves money and also ...
- 1,040
4
votes
Accepted
Wildcard SSL and EV SSL
Yes, this is possible. When the www or root domain are accessed, the users will see the green bar in the browser, since those sites will be returning the EV certificate. When a user loads a page ...
- 35.4k
4
votes
Accepted
Is there a difference in security between an IP address white list and a domain white list with TLS?
tl;dr: different things, both useful for different scenarios, IP whitelisting is not a bad sign
You are indeed comparing apples and oranges.
IP-based filtering happens at the network layer of the ...
- 14.3k
4
votes
Are there still some ssl domains containing the nul character for testing purposes?
There is no such thing as an "SSL domain".
There is no NUL-handling bug in SSL, which is a specification. Only bugs in implementations. Lots of bugs. In these bugs, there never was a NUL character ...
- 750
4
votes
Accepted
Subdomain Takeover
Subdomains cannot be registered.
Domains are registered, and then the designated Nameservers (DNS Servers) are able to control the subdomains.
In many cases, the Registrar is also handling ...
- 13.8k
4
votes
Subdomains - Security Risk?
Is it possible for a 3rd party to own a sub-domain of my xxx.com site?
No, other folks cannot own register subdomains for a domain which you have already registered.
Here's the ownership tree.
The ...
- 13.8k
4
votes
Subdomain takeover due to improper records
Snapchat had this Fastly instance set up, but eventually cancelled their service. However, they had forgotten to remove the DNS record, which allowed this researcher to simply to register a new Fastly ...
- 47
3
votes
Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?
NO! You have now shared your key with someone you can't trust to keep it safe.
YES! This way if their key gets compromised or your key gets compromised, the other key is safe, and so are those systems/...
- 6,971
3
votes
SSL Cert for sub.domain.com and www.sub.domain.com
Wildcard SSL protects the unlimited numbers of subdomains in the terms of all are created on your main domain name.
When Wildcard SSL certificate issued for *.domain.com, that can secure…
sub1....
- 51
3
votes
Security implications of providing users subdomains on my domain?
Yes, they could poison cookies on your domain to execute say a Session Fixation attack.
e.g.
The attacker visits your main website www.example.com and gets a session ID.
The attacker adds some ...
- 33.2k
3
votes
How can I find subdomains of a site?
Jason Haddix wrote my favorite subdomain/hostname discovery tool that depends on a very-recent version of recon-ng -- available here -- https://github.com/jhaddix/domain
subbrute is decent, fierce -...
- 18.9k
3
votes
Accepted
How could you find wildcard subdomains on websites?
The first answer doesn't technically answer the question.
Official Method
There's only one official method of doing this using the dig command:
dig @ns.thenameserver.net example.com axfr
AXFR is a ...
- 236
3
votes
Does HSTS inlcudeSubDomains directive include subdomains on all levels?
Yes, this should apply to all subdomains (see Steffen Ullrich's comment for caveat).
In foo.bar.foobar, foo is a subdomain of bar.foobar, and bar is a subdomain of foobar, so therefore foo.bar.foobar ...
- 33.2k
Only top scored, non community-wiki answers of a minimum length are eligible