8 ms·

This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone. I wonder --

This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone. I wonder -- has anyone written code to spin up EC2 instances and check for subdomains pointing to the IP? Not sure how you could do that efficiently (does rdns work after the IP has been recycled?), but a starting point might be gathering as many NXDOMAIN subdomains as possible, filtering the ones at cloud providers, and starting instances until you get a match.

phlo 9y ago
> Not sure how you could do that efficiently... You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time. RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.
- slrz 9y ago
  GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.
praseodym 9y ago
Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.
- petercooper 9y ago
  I believe https://securitytrails.com/ https://securitytrails.com/ is a new player in this space
Operyl 9y ago
Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70 https://www.bing.com/search?q=ip%3A208.109.192.70 If you're fast enough, it could still be cached in bing when you search.
- wpietri 9y ago
  That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.
- acangiano 9y ago
  Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.
  - styfle 9y ago
    Is it a private server? It might be a shared host so that many domains are pointing to the same IP.
    - acangiano 9y ago
      Yes, private server with dedicated IP.
- textmode 9y ago
  https://api.hackertarget.com/reverseiplookup/?q=208.109.192.70 https://api.hackertarget.com/reverseiplookup/?q=208.109.192....
  - iforgotpassword 9y ago
    Try passing 1.1.1.1 if you want a no-js version of the infinitely scrolling website.
mandatory 9y ago
I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-pool-for-dangling-domains/ https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...
- gowld 9y ago
  Is it possible for IPv4 to not recycle IPs? Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)
  - mirimir 9y ago
    For IPv4, clearly no, at this point. For IPv6, clearly yes, at least so far. It's pretty typical to get at least a /64 aka LAN with a VPS. That's 18 x 10^18 addresses. ISP customers typically get a /56 (256 LANs) or a /48 (65536 LANs).
dan-c 9y ago
I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs https://gist.github.com/rxall/5305bcaa008e51685998 https://gist.github.com/rxall/5305bcaa008e51685998
stephengillie 9y ago
I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool. As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.
- chatmasta 9y ago
  Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP. Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
  - stephengillie 9y ago
    We didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person. There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
- wjoe 9y ago
  Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.
  - chatmasta 9y ago
    Definitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.
alex_young 9y ago
Should be simple. Just log 'host' header from http terminations, right?
julianj 9y ago
I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec. https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclintoncom_subdomain_is_pointing_to_my/ https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...

phlo 9y ago

> Not sure how you could do that efficiently... You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time. RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.

slrz 9y ago
GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.

praseodym 9y ago

Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.

petercooper 9y ago
I believe https://securitytrails.com/ https://securitytrails.com/ is a new player in this space

Operyl 9y ago

Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70 https://www.bing.com/search?q=ip%3A208.109.192.70 If you're fast enough, it could still be cached in bing when you search.

wpietri 9y ago
That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.
acangiano 9y ago
Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.
- styfle 9y ago
  Is it a private server? It might be a shared host so that many domains are pointing to the same IP.
  - acangiano 9y ago
    Yes, private server with dedicated IP.
textmode 9y ago
https://api.hackertarget.com/reverseiplookup/?q=208.109.192.70 https://api.hackertarget.com/reverseiplookup/?q=208.109.192....
- iforgotpassword 9y ago
  Try passing 1.1.1.1 if you want a no-js version of the infinitely scrolling website.

mandatory 9y ago

I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-pool-for-dangling-domains/ https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...

gowld 9y ago
Is it possible for IPv4 to not recycle IPs? Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)
- mirimir 9y ago
  For IPv4, clearly no, at this point. For IPv6, clearly yes, at least so far. It's pretty typical to get at least a /64 aka LAN with a VPS. That's 18 x 10^18 addresses. ISP customers typically get a /56 (256 LANs) or a /48 (65536 LANs).

dan-c 9y ago

I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs https://gist.github.com/rxall/5305bcaa008e51685998 https://gist.github.com/rxall/5305bcaa008e51685998

stephengillie 9y ago

I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool. As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.

chatmasta 9y ago
Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP. Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
- stephengillie 9y ago
  We didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person. There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
wjoe 9y ago
Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.
- chatmasta 9y ago
  Definitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.

alex_young 9y ago

Should be simple. Just log 'host' header from http terminations, right?

julianj 9y ago

I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec. https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclintoncom_subdomain_is_pointing_to_my/ https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...