Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did the internet discover my subdomain?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 322 posts

Re: Ask HN: How did the internet discover my subdomain?

#191

Post by yatralalala »

alexjplant wrote: post #27
codingdave wrote: post #2

If it is on DNS, it is discoverable. Even if it were not, the message you pasted says outright that they scan the entire IP space, so they could be hitting your server's IP without having a clue there is a subdomain serving your stuff from it.

> If it is on DNS, it is discoverable. In the context of what OP is asking this is not true. DNS zones aren't enumerable - the only way to reliably get the complete contents of the zone is to have the SOA server approve a zone transfer and send the zone file to you. You can ask if a record in that zone exists but as a random user you can't say "hand over all records in this zone". I'd imagine that tools like Cloudfla…

Zone transfers are super interesting topic. Thanks for mentioning that.

It's basically the way how to get all DNS records a DNS server has. Interestingly in some countries this is illegal and in some this is considered best practice.

Generally, enabled zone transfers is considered as misconfiguration and should be disabled.

We did research on that few months back and found out that 8% of all global name servers have it enabled.[0]

[0] - https://reconwave.com/blog/post/alarming-prevalence-of-zone-...

Re: Ask HN: How did the internet discover my subdomain?

#192

Post by yatralalala »

EQYV wrote: post #12
codingdave wrote: post #2

If it is on DNS, it is discoverable. Even if it were not, the message you pasted says outright that they scan the entire IP space, so they could be hitting your server's IP without having a clue there is a subdomain serving your stuff from it.

Question: How does a subdomain get discovered by a member of the public if there are no references to it anywhere online? The only thing I can think of that would let you do that would be a DNS zone transfer request, but those are almost always disallowed from most origin IPs. https://en.m.wikipedia.org/wiki/DNS_zone_transfer

See my comment above https://news.ycombinator.com/item?id=43289743 there are many techniques!

Re: Ask HN: How did the internet discover my subdomain?

#193

Post by monkaiju »

sl1ckback wrote: post #173
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

[flagged]

This is the most confidently incorrect post I've seen in a long time.

Re: Ask HN: How did the internet discover my subdomain?

#194

Post by crazygringo »

sl1ckback wrote: post #173
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

[flagged]

> “Security through obscurity” is the only security there is.

> Encryption obscures data.

I don't think you understand what "security through obscurity" means. What encryption does is literally the opposite of obscure, in this context. It is out in the open and documented. And the same with the rest of your examples.

Re: Ask HN: How did the internet discover my subdomain?

#195

Post by crazygringo »

p0w3n3d wrote: post #187
melevittfl wrote: post #121

Earlier quoted context omitted.

But there's no evidence in the OP's post that they have, in fact, discovered the domain. The only thing posted is that there is a GET request to a listening web server. The OP and all the people talking about certificates are making the same assumption. Namely that the scanning company discovered the DNS name for the server and tried to connect. When, if fact, they simply iterate through IP address blocks and make ge…

OP states that the domain was discovered

No they didn't. They said "How did the internet find my subdomain?" They're assuming the internet found their subdomain. They don't provide any evidence that happened, just that they found their IP address.

Re: Ask HN: How did the internet discover my subdomain?

#196

Post by MyOutfitIsVague »

sl1ckback wrote: post #173
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

[flagged]

That's not what that phrase means. That's not even what the word "obscure" means. Obscurity is trying to not draw attention to something, or keep it hidden (as in "nobody knows that it's there", not "you know that it's there but can't access it"). Encryption doesn't obscure data unless you're stretching the definition of the word beyond its useful purpose.

Re: Ask HN: How did the internet discover my subdomain?

#198

Post by binarymax »

1970-01-01 wrote: post #184
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

Subdomainfinder.com ?? Dozens of others will also find it. Really, it's this simple today.

I think your comment resulted in a hug of death for that service ;)

Re: Ask HN: How did the internet discover my subdomain?

#200

Post by purkka »

sl1ckback wrote: post #173
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

[flagged]

"Security through obscurity" can definitely be defined in a meaningful way.

The opposite of "bad security through obscurity" is using completely public and standard mechanisms/protocols/algorithms such as TLS, PGP or pin tumbler locks. The security then comes from the keys and other secrets, which are chosen from the space permitted by the mechanism with sufficient entropy or other desirable properties.

The line is drawn between obscuring the mechanism, which is designed to have measurable security properties (cryptographic strength, enumeration prevention, lock security pins), and obscuring the keys that are essentially just random hidden information.

Obscuring the mechanism provides some security as well, sure, but a public mechanism can be publicly verified to provide security based only on secret keys.

Post reply on HN