Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did the internet discover my subdomain?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 322 posts

Re: Ask HN: How did the internet discover my subdomain?

#41

Post by hombre_fatal »

andix wrote: post #40
hombre_fatal wrote: post #35

Earlier quoted context omitted.

Most servers just listen on :80 and respond to all requests. Almost nobody checks the host header intentionally, it's just a happy mistake if they use a reverse proxy. You can often decloak servers behind Cloudflare because of this. But OP's post already answered their question: someone scanned ipv4 space. And what they mean is that a server they point to via DNS is receiving requests, but DNS is a red herring.

This really depends on the setup. Most web servers host multiple virtual hosts. IP addresses are expensive. If you're deploying a service behind a reverse proxy, it either must be only accessible from the reverse proxy via an internal network, or check the IP address of the reverse proxy. It absolutely must not trust X-Forwarded-For: headers from random IPs.

I just don't see how any of this matters. OP's server is reachable via ipv4 and someone sent an http request to it. Their post even says that this is the case.

Re: Ask HN: How did the internet discover my subdomain?

#42

Post by andix »

fsckboy wrote: post #24

LPT, this is an object lesson in the weakness of security through obscurity

Security by obscurity can be a great additional measure for an already secure system. It can reduce attack surface, make it less likely to get attacked in the first place. In some cases (like this one) it can also be much easier to break than expected.

Re: Ask HN: How did the internet discover my subdomain?

#43

Post by andix »

hombre_fatal wrote: post #41
andix wrote: post #40

Earlier quoted context omitted.

This really depends on the setup. Most web servers host multiple virtual hosts. IP addresses are expensive. If you're deploying a service behind a reverse proxy, it either must be only accessible from the reverse proxy via an internal network, or check the IP address of the reverse proxy. It absolutely must not trust X-Forwarded-For: headers from random IPs.

I just don't see how any of this matters. OP's server is reachable via ipv4 and someone sent an http request to it. Their post even says that this is the case.

I'm guessing they meant it discovered a virtual host behind a subdomain.

Re: Ask HN: How did the internet discover my subdomain?

#44

Post by andix »

parliament32 wrote: post #38
andix wrote: post #31

Earlier quoted context omitted.

Port scanning usually can't discover subdomains. Most servers don't expose the of the domains they server content for. In case of HTTP they usually only serve the subdomain content if the Host: request-header includes it.

How deep in the domain hierarchy you are doesn't matter from a network layer: a bare tld (yes this exists), a normal domain, a subdomain, a sub-subdomain, etc can all be assigned different IPs and go different places. You can issue a GET against / for any IP you want (like we see in the logs OP posted). The only time this would actually matter is if a host at an address is serving content for multiple hostnames and d…

You can discover IP adresses, sure. Just enumerate them. But this doesn't give you the domain, as long as there is no reverse dns record.

I'm quite sure OP meant a virtual host only reachable with the correct Host: header.

Re: Ask HN: How did the internet discover my subdomain?

#45

Post by LinuxBender »

As others have said, likely cert transparency logs. Use a wildcard cert to avoid this. They are free using LetsEncrypt and possibly a couple other ACME providers. I have loads of wildcard certs. Bots will try guessing names but like you I do not use easily guessable names and the bots never find them. I log all DNS answers. I assume cloudflare supports strict-SNI but no idea if they have their own automation around wildcard certs. Sometimes I renew wildcard certs I am not even using just to give the bots something to do.

Re: Ask HN: How did the internet discover my subdomain?

#47

Post by ciaovietnam »

There is a chance that your subdomain is the first/default virtual host in your web server setup (or the subdomain's access log is the default log file) so any requests to the server's IP address get logged to this virtual host. That means they didn't access your subdomain, they accessed via your server IP address but got logged in your subdomain's access log.

Re: Ask HN: How did the internet discover my subdomain?

#49

Post by giancarlostoro »

parliament32 wrote: post #14

Certificate Transparency logs, or they don't actually know the domain name: just port-scanning[1] then making requests to open web ports. [1] Turns out you can port-scan the entire internet in under 5 minutes: https://github.com/robertdavidgraham/masscan

Last few times I tried to do this my ISP cut off my internet every time. Assholes. It comes back, but they're still assholes for it.

Re: Ask HN: How did the internet discover my subdomain?

#50

Post by icehawk »

parliament32 wrote: post #14

Certificate Transparency logs, or they don't actually know the domain name: just port-scanning[1] then making requests to open web ports. [1] Turns out you can port-scan the entire internet in under 5 minutes: https://github.com/robertdavidgraham/masscan

This.

I have a DNS client that feeds into my passive DNS database by reading CT logs and then trying to resolve them.

Post reply on HN