3 ms·
Not sure why everyone is going on about certificate transparency logs when the answer is right there in the user agent. The company is scanning the ipv4 space a
by paxys 2y ago
Not sure why everyone is going on about certificate transparency logs when the answer is right there in the user agent. The company is scanning the ipv4 space and came upon your IP and port.
- deleted 2y ago[deleted]
- pkulak 2y agoOkay. But how did they get the proper host header?
- peeters 2y agoThere are a couple easy possibilities depending on server config. 1. Not using SNI, and all https requests just respond with the same cert. (Example, go to https://209.216.230.207/ https://209.216.230.207/ and you'll get a certificate error. Go to the cert details and you'll see the common name is news.ycombinator.com). 2. http upgrades to https with a redirect to the hostname, not IP address. (Example, go to http://209.216.230.207/ http://209.216.230.207/ and you get a 301 redirect to https://news.ycombinator.com https://news.ycombinator.com)
- jimnotgym 2y agoI don't think op said that they had the correct host header?
- INTPenis 2y agoCould be a number of ways for example a default TLS cert, or a default vhost redirect. I actually had a job once a few years ago where I was asked to hide a web service from crawlers and so I did some of these things to ensure no info leaked about the real vhost.
- paxys 2y agoWho says they did?
- peeters 2y agoIt's rather hilarious that nobody mentioned this in 7 hours. What am I missing? ~5 billion scans in a few hours is nothing for a company with decent resources. OP: in case you didn't follow, they're literally trying every possible IPv4 address and seeing if something exists on standard ports at that address. I believe it would be harder to find out your domain that way if you were using SNI and only forwarded/served requests that used the correct host. But if you aren't using SNI, your server is probably just responding to any TLS connect request with your subdomain's cert, which will reveal your hostname.
- Dylan16807 2y ago> What am I missing? That it was in fact mentioned many hours earlier, in more than one top level comment.
- peeters 2y agoI was referring more to the fact that the user agent explicitly contained the answer, rather than suggestions that it was IP scanning. But you're right I do see one comment that mentions that. And many more likely assumed the OP already figured that part out.
- Dylan16807 2y agoThe user agent contains a partial answer. IP scanning doesn't give you the actual subdomain, so the question is slightly wrong or there are missing pieces.
- diggan 2y agoJudging by the logs (user agents really) right now in the submission, it's hard to tell if the requests were actually for the domain (since the request headers aren't included) or just for the IP.
- Dylan16807 2y ago
- ozim 2y agoThat perfectly fits midwit meme. Lots of people are smart enough to know transparency logs - but not smart enough to read OP post and understand the details.
- seba_dos1 2y agoThe details aren't there, so it's "assume" rather than "understand". The only proper response to OP's question is to ask for clarification: is the subdomain pointing to a separate IP? Are the logs vhost-specific or not? If you don't get the answers, all you can do is to assume, and both assumptions may end up being right or wrong (with varying probability, perhaps).
- 4ndrewl 2y agoAlso it's Palo Alto. They're not some kiddie scripters. https://en.m.wikipedia.org/wiki/Palo_Alto_Networks https://en.m.wikipedia.org/wiki/Palo_Alto_Networks
- chinathrow 2y agoHm? They sell you security but provide you with CVEs en masse. https://www.cybersecuritydive.com/news/palo-alto-networks--hackers-exploit-flaw/740748/ https://www.cybersecuritydive.com/news/palo-alto-networks--h...
- heraldgeezer 2y agoAh yes we all know if you sell a firewall the code has to be 100% bug free unbreakable
- ThatMedicIsASpy 2y agoAm I google when I come with the useragent 'google here, no evil'?
- bildung 2y agoLooking at how they earned their 100s of CVEs, script kiddie almost looks like a compliment
- p0w3n3d 2y agoFinding IP does not mean finding the domain. When doing HTTP request to IP you specify the domain you want to connect to. For example you can configure your /etc/hosts to have xxxnakedhamsters.google.com pointing to 8.8.8.8 and make the http request, which will cause Google getting the domain request (i.e. header Host: xxxnakedhamsters.google.com) and it will refuse it or try to redirect to http. Of course it's only related to HTTP because HTTPS will require certificate. That's why they're speaking about certificates.
- ghusto 2y agoFirst thing I’d do for an IP that answers is a reverse lookup, so I expect that’s at least in the list of things they’d try.
- lewiscollard 2y agoDepending on the web server's configuration, you very much _can_ find the domain which is configured on an IP address, by attempting to connect to that IP address via HTTPS and seeing what certificate gets served. Here's an example: https://138.68.161.203/ https://138.68.161.203/ > Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 138.68.161.203. The certificate is only valid for the following names: exhaust.lewiscollard.com, www.exhaust.lewiscollard.com
- jchw 2y agoI don't think that does you any good for Cloudflare, though. They will definitely be using SNI.
- kelnos 2y agoThat doesn't really matter, though. While OP is using Cloudflare, the actual server behind it is still a publicly-accessible IP address that an IPv4 space scanner can easily stumble upon.
- 2y ago