4 ms·
One time I created a virtual machine on some cloud platform and after checking the traffic logs, found out that Coke had some random disused subdomain pointing
by morpheuskafka 5y ago
One time I created a virtual machine on some cloud platform and after checking the traffic logs, found out that Coke had some random disused subdomain pointing to my new IP that was still getting traffic daily.
Does anyone here have an idea of how common this kind of mistake is? Would it be a viable strategy for an attacker to just iterate through VMs on a common service like AWS until one happens to get traffic on an interesting domain?
- rhtgrg 5y agoI recall seeing something similar happening with subdomains and S3 [0] not too long ago, albeit that issue didn't involve DNS. [0] https://news.ycombinator.com/item?id=28351432 https://news.ycombinator.com/item?id=28351432
- iancarroll 5y agoI and many other bug bounty researchers have tools that allocate AWS elastic IPs on a loop, looking for domains that point to them. (You don't get to pick what IP you get, so you just have to pray for a good one!) It is a very profitable way to find vulnerabilities, but AWS detects and bans researchers for this activity. It's very, very easy to find random domains pointing to AWS IPs, although harder to find ones where the company has a bug bounty program. :)