CNAME Record 0r A Record —> Points to third party services
Check:
for take-overs is to query a list of domains and check for any that are either:
1. attached to a third party domain or destination via the use of a cname record
2.return a 404 not found error.
example : domain that resolved to a CloudFront domain which gave the following error: "Error the request could not be satisfied, generated by CloudFront (CloudFront)"
Technical Detail
This attack vector utilizes DNS entries pointing to Service Providers where the pointed subdomain is currently not in use
Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.
Another senario:
1. A Domain Owner points their * (wildcard) DNS-entry to e.g. Heroku.
2. They forget to add the wildcard-entry to their Heroku-app.
3. Attacker can now claim any subdomain they want from the Domain Owner.
4. A Domain Owner will be unaware of the subdomain being exploited.
In the not so rare case, the attacker can also “inherit” the Domain Owner’s Wildcard SSL used inside the Service Provider.
Exploit
Claim CloudFront:
Singup to AWS —> head over CloudFront signup
Remediation
- Check your DNS-configuration for subdomains pointing to services not in use.
- Set up your external service so it fully listens to your wildcard DNS. In Heroku’s case, this means running the following command in your App: heroku domains:add *.[example.com](http://example.com/)
Reference
POC
- I found a website, for now call it [www.target.com](http://www.target.com)
- I went to terminal and run a host command on that target
host www.target.com
- it was pointing its 'A' record to 23.227.38.65 this IP
- Now i knew that this IP belongs to shopify cause i had setup a shop on shopify few days back (you can also go and check with whois record for this ip)
- I opened the website [www.target.com](http://www.target.com) , I found there shopify template stating "only one step left to finish setting" (In some cases : it also state Sorry this shop is unavailable)
- Now i knew what i have to do, i sing-up on shopify with trial account, after that i put the same target website name, it gave me error stating application name already exist, so put target.com as a name, finally it was created.
- I went to setting, it shows me two option "connect your domain automatically" and "connect you domain manually"
- I choose first one automatic one, just put that domain [www.target.com](http://www.target.com) , it got connected. We are done, now we owns this top level domain.
Analysis
- The person registered this domain name from godaddy , and configured its DNS record pointing to shopify IP
- Either he might had forgotten to create a shop or he had created a shop used it for a while then deleted that shop from shopify but didn't removed the DNS entry pointing to shopify's IP