# Subs or Top level Domain

* CNAME Record 0r A Record —> Points to third party services
* Check:

```
     for take-overs is to query a list of domains and check for any that are either:

    1. attached to a third party domain or destination via the use of a cname record 

    2.return a 404 not found error.

    example : domain that resolved to a CloudFront domain which gave the following error: "Error the request could not be satisfied, generated by CloudFront (CloudFront)"
```

### Technical Detail

* This attack vector utilizes DNS entries pointing to Service Providers where the pointed subdomain is currently not in use
* Service providers :

```
    Heroku, Github, Bitbucket, Squarespace, Shopify, Desk, Teamwork, Unbounce, Helpjuice, HelpScout, Pingdom, Tictail, Campaign Monitor, CargoCollective, [StatusPage.io](http://statuspage.io/) and Tumblr.
```

### Impact

* Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.
* Another senario:

```
    1. A Domain Owner points their * (wildcard) DNS-entry to e.g. Heroku.
    2. They forget to add the wildcard-entry to their Heroku-app.
    3. Attacker can now claim any subdomain they want from the Domain Owner.
    4. A Domain Owner will be unaware of the subdomain being exploited.
```

* In the not so rare case, the attacker can also “inherit” the Domain Owner’s Wildcard SSL used inside the Service Provider.

### Exploit

* Claim CloudFront:

```
    Singup to AWS —> head over CloudFront signup
```

### Remediation

```
    - Check your DNS-configuration for subdomains pointing to services not in use.
    - Set up your external service so it fully listens to your wildcard DNS. In Heroku’s case, this means running the following command in your App: heroku domains:add *.[example.com](http://example.com/)
```

### Reference

* Detectify article :[https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/)
* Zsec Blog: [https://blog.zsec.uk/subdomainhijack/](https://blog.zsec.uk/subdomainhijack/)

### POC

```
- I found a website, for now call it [www.target.com](http://www.target.com)  
- I went to terminal and run a host command on that target

host www.target.com

- it was pointing its 'A' record to  23.227.38.65 this IP 
- Now i knew that this IP belongs to shopify cause i had setup a shop on shopify few days back (you can also go and check with whois record for this ip)
- I opened the website [www.target.com](http://www.target.com) , I found there shopify template stating  "only one step left to finish setting" (In some cases : it also state Sorry this shop is unavailable) 
- Now i knew what i have to do, i sing-up on shopify with trial account, after that i put the same target website name, it gave me error stating application name already exist, so put target.com as a name, finally it was created.
- I went to setting, it shows me two option "connect your domain automatically" and "connect you domain manually"
- I choose first one automatic one, just put that domain [www.target.com](http://www.target.com) , it got connected. We are done, now we owns this top level domain.
```

### Analysis

```
- The person registered this domain name from godaddy , and configured its DNS record pointing to shopify IP
- Either he might had forgotten to create a shop or he had created a shop used it for a while then deleted that shop from shopify but didn't removed the DNS entry pointing to shopify's IP
```

\*\* Pardon for any spelling or grammar mistake \*\*

### Author:

* Twitter Id: @Zero0x00
