Subdomain-Takeover子域名接管原理和利用案例

sub.expample.com(常规域名) 60 IN CNAME anotherdomain.com.(规范域名)

dig ns wolframe.eu@8.8.8.8 +nostats

import dns
import dns.rdatatype

for NAMESERVER_IP in NAMESERVER_IPS:
    custom_resolver = dns.resolver.Resolver()
    custom_resolver.nameservers = [NAMESERVER_IP]
    q = custom_resolver.query(DOMAIN, dns.rdatatype.A)

#!/bin/bash
#!Coded by Suleman Malik
#!www.sulemanmalik.com

cont(){
rm /tmp/cnames
rm /tmp/cname-ln
rm /tmp/fn-py
}
bl(){
  echo -e "\033[0;31m-------------------------------------------------------------\033[0m"
}
ban(){
echo '''
  ________                                                                   
 /__  ___/                                                           
   / /   ___     / ___      ___      ___              ___      __    
  / /  //   ) ) //\ \     //___) ) //   ) ) ||  / / //___) ) //  ) ) 
 / /  //   / / //  \ \   //       //   / /  || / / //       //       
/ /  ((___( ( //    \ \ ((____   ((___/ /   ||/ / ((____   //        
'''
}
cont > /dev/null 2>&1
clear                                                                        
ban
echo -e "\033[0;32m  @sulemanmalik_3                              v1\033[0m"
bl
echo "File Name:"
read inp
echo ''
echo ''
cot=0
lof=$(wc -l < $inp | sed 's/ //g')
while read dom
do 
  cot=$(($cot + 1))
  echo -ne "\033[0;32mScanning Subdomains:\033[0m $cot/$lof\r"
  cname=$( dig CNAME $dom | grep "CNAME" | tail -n1 | cut -c"29-" | sed 's/^.*E//' >> /tmp/cnames)
  echo "$cot - $dom --> " >> /tmp/cname-ln
done < $inp
  prog=$(awk 'NR==FNR{a[++y]=$0;next}{b[++x]=$0}
  END{z=x>y?x:y;while(++i<=z){print a[i],b[i]}}' /tmp/cname-ln /tmp/cnames > /tmp/fn-py)
echo ''
echo ''
cat /tmp/fn-py
sleep 1
echo ''
bl
cont > /dev/null 2>&1

$ nslookup c1h2e1.github.io
$ host c1h2e1.github.io
$ dig c1h2e1.github.io

#podcasts.slack-core.com是CNAME'd to redirect.feedpress.me:
$ dig podcasts.slack-core.com 

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;podcasts.slack-core.com.   IN  A

;; ANSWER SECTION:
podcasts.slack-core.com. 299    IN  CNAME   redirect.feedpress.me.
redirect.feedpress.me.  3599    IN  A   5.135.16.40

;; Query time: 253 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)

curl https://cli-assets.heroku.com/install.sh | sh

cd ~
mkdir herokudeploy
cd herokudeploy
echo "{}" > composer.json
echo "Subdomain takeover PoC" > index.html
touch index.php

#编辑index.php
<?php header( 'Location: /index.html' ) ; ?>

#接下来，
git init
git add .
git commit -m "just simple poc"
heroku apps:create justsimplesubdomaintakeoverpoc

$ curl -I www.leifroswold.com
HTTP/1.1 404 Not Found
Server: openresty
Date: Mon, 24 Sep 2018 15:14:30 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Rid: 57de79ef9b33ae549a1795eecfd68570
P3p: CP=Tumblr s privacy policy is available here: https://www.tumblr.com/policy/en/priva

#用dig查看他以前用过的tumblr用户名。
$ dig www.leifroswold.com
.....
;; ANSWER SECTION:
www.leifroswold.com.    942     IN      A       66.6.44.4  #这里配置错误实际应该设置CNAME指向字节Tumblr域名

Engine 	Possible 	Fingerprint 	Reference
AWS/S3 	Yes 	The specified bucket does not exist
Bitbucket 	Yes 	Repository not found
Campaign Monitor 	Yes 	Support Page
Cargo Collective 	Yes 	404 Not Found 	Cargo Support Page
Cloudfront 	Yes 	Bad Request: ERROR: The request could not be satisfied 	https://blog.zsec.uk/subdomainhijack/
Desk 	No
Fastly 	Yes 	Fastly error: unknown domain:
Feedpress 	Yes 	The feed has not been found. 	https://hackerone.com/reports/195350
Freshdesk 	No 	Freshdesk Support Page
Ghost 	Yes 	The thing you were looking for is no longer here, or never was
Github 	Yes 	There isn't a Github Pages site here. 	https://hackerone.com/reports/263902
Gitlab 	No 	https://hackerone.com/reports/312118
Google Cloud Storage 	No
Help Juice 	Yes 	We could not find what you're looking for. 	Help Juice Support Page
Help Scout 	Yes 	No settings were found for this company: 	HelpScout Docs
Heroku 	Yes 	No such app
JetBrains 	Yes 	is not a registered InCloud YouTrack
Mashery 	No 	Unrecognized domain 	https://hackerone.com/reports/275714
Microsoft Azure 	Yes
Sendgrid 	No
Shopify 	Yes 	Sorry, this shop is currently unavailable.
Squarespace 	No
Statuspage 	Yes 	You are being redirected 	https://hackerone.com/reports/49663
Surge.sh 	Yes 	project not found 	https://surge.sh/help/adding-a-custom-domain
Tumblr 	Yes 	Whatever you were looking for doesn't currently exist at this address
Tilda 	No 	Please renew your subscription
Unbounce 	Yes 	The requested URL was not found on this server. 	https://hackerone.com/reports/202767
UserVoice 	Yes 	This UserVoice subdomain is currently available!
Wordpress 	Yes 	Do you want to register *.wordpress.com?
WP Engine 	No
Zendesk 	Yes 	Help Center Closed 	Zendesk Support

dig agilesysadmin.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> agilesysadmin.com
;; global options: +cmd
.......
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;agilesysadmin.com. IN A

;; ANSWER SECTION:
agilesysadmin.com. 3599 IN A 45.55.110.124

mkdir surge
cd surge
nano index.html