Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did the internet discover my subdomain?

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 322 posts

Re: Ask HN: How did the internet discover my subdomain?

#281

Post by BLKNSLVR »

drpossum wrote: post #159
BLKNSLVR wrote: post #110

There are a number of companies, not just Palo Alto Networks, that perform various different scales of scans of the entire IPv4 space, some of them perform these scans multiple times per day. I setup a set of scripts to log all "uninvited activity" to a couple of my systems, from which I discovered a whole bunch of these scanner "security" companies. Personally, I treat them all as malicious. There are also services…

How does an ip scan help with general DNS resolution at all?

They scan certain ports as well, which can provide them with 'fingerprints' as to what's running on those ports, which can then invite further investigation.

If ports 80 or 443 are open and there's a web server fingerprint (Apache, nginx, caddy, etc) then they could use further tools to try to discover domain names etc.

Re: Ask HN: How did the internet discover my subdomain?

#282

Post by BLKNSLVR »

immibis wrote: post #169
yabones wrote: post #148

Earlier quoted context omitted.

I do something similar. Any hits on the default nginx vhost get logged, logs get parsed out and "repeat offenders" get put on the shitlist. I use ipset/iptables but this can also be done with fail2ban quite simply. https://nbailey.ca/post/block-scanners/

This is security theater.

No, it's security by obscurity which is a single, but important, step above security theatre.

To not appear on the radar is to not invite investigation; if they can't see the door they won't try to pry it open.

If you're already on their radar, or if they already know the door is there (even if they can't directly see it), then it's less effective.

Re: Ask HN: How did the internet discover my subdomain?

#283

Post by BLKNSLVR »

nkmnz wrote: post #151
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

[flagged]

I assumed they do it for customers who pay them to determine their security profile.

Re: Ask HN: How did the internet discover my subdomain?

#284

Post by [deleted] »

jchw wrote: post #115
lewiscollard wrote: post #106

Earlier quoted context omitted.

Depending on the web server's configuration, you very much _can_ find the domain which is configured on an IP address, by attempting to connect to that IP address via HTTPS and seeing what certificate gets served. Here's an example: https://138.68.161.203/ > Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 138.68.161.203. The certifi…

I don't think that does you any good for Cloudflare, though. They will definitely be using SNI.

[deleted]

Re: Ask HN: How did the internet discover my subdomain?

#285

Post by ratg13 »

jchw wrote: post #133
kelnos wrote: post #124

Earlier quoted context omitted.

That doesn't really matter, though. While OP is using Cloudflare, the actual server behind it is still a publicly-accessible IP address that an IPv4 space scanner can easily stumble upon.

I misunderstood, I thought the subdomain was an R2 bucket. If it's just normal Cloudflare proxying to some backend this is probably the most likely answer. That said, while I think it's not the case here, using Cloudflare doesn't mean the underlying host is accessible, as even on the free tier you can use Cloudflare Tunnels, which I often do.

they only state they are using cloudflare for DNS, they didn't say if they were proxying the connection

Re: Ask HN: How did the internet discover my subdomain?

#286

Post by [deleted] »

TZubiri wrote: post #275
lyu07282 wrote: post #163

Earlier quoted context omitted.

> Obscurity is a fine strategy > Subdomains can be passwords and a well crafted subdomain should not leak Your comment is really odd to read I'm not sure I understand you, but I'm sure you don't mean it like that. Just to re-iterate the important points: 1. Do not rely on subdomains for security, subdomains can easily leak in innumerable ways including in ways outside of your control. 2. Security by obscurity must ne…

It's a pretty weak cve category. "The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism." If you can defeat the mechanism, that's not very impactful if it's one stage of a multi-round mechanism. Especially if vulnerating or crossing that perimeter alerts the admin! Lots of uncreative blue teamers…

[deleted]

Re: Ask HN: How did the internet discover my subdomain?

#287

Post by compootr »

AtNightWeCode wrote: post #260
yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

So to mostly prevent this. Disable direct IP access. Use wildcard certificates. Don't use guessable subdomains like www or mail.

security through obscurity just isn't. keep your shiz up to date and use proper access controls!

Re: Ask HN: How did the internet discover my subdomain?

#288

Post by [deleted] »

alexjplant wrote: post #27
codingdave wrote: post #2

If it is on DNS, it is discoverable. Even if it were not, the message you pasted says outright that they scan the entire IP space, so they could be hitting your server's IP without having a clue there is a subdomain serving your stuff from it.

> If it is on DNS, it is discoverable. In the context of what OP is asking this is not true. DNS zones aren't enumerable - the only way to reliably get the complete contents of the zone is to have the SOA server approve a zone transfer and send the zone file to you. You can ask if a record in that zone exists but as a random user you can't say "hand over all records in this zone". I'd imagine that tools like Cloudfla…

[deleted]

Re: Ask HN: How did the internet discover my subdomain?

#289

Post by jchw »

ratg13 wrote: post #285
jchw wrote: post #133

Earlier quoted context omitted.

I misunderstood, I thought the subdomain was an R2 bucket. If it's just normal Cloudflare proxying to some backend this is probably the most likely answer. That said, while I think it's not the case here, using Cloudflare doesn't mean the underlying host is accessible, as even on the free tier you can use Cloudflare Tunnels, which I often do.

they only state they are using cloudflare for DNS, they didn't say if they were proxying the connection

Also a valid point. I guess without more details all we can really do is speculate about the exact setup. That said, I do now agree that the most likely answer is "the underlying host was accessible and caught by an IPv4 scanner" since well, that's pretty much what it says anyway.

Re: Ask HN: How did the internet discover my subdomain?

#290

Post by 3np »

geek_at wrote: post #263
no-dr-onboard wrote: post #254

Earlier quoted context omitted.

Hi, former pentester here. If any one of your trusted clients is using a google/chromium based browser, the telemetry from that browser (webdiscovery) would reveal the existence of the subdomain in question. As others have said, security by obscurity doesn't work.

Current pen tester here and this guy is right. There was a Google blog post years ago where Google planted a site with an unguessable url and indexed it and used edge to surf on the site. Shortly after this site was also listed on Bing. Google had a "gotcha" moment when Microsoft responded basically with "yeah we didn't steal it from Google, you had telemetry enabled" Total shitshow

Would love to read this if a link is still around
Post reply on HN