51–60 of 322 posts
Certificate Transparency logs, or they don't actually know the domain name: just port-scanning[1] then making requests to open web ports. [1] Turns out you can port-scan the entire internet in under 5 minutes: https://github.com/robertdavidgraham/masscan
This. I have a DNS client that feeds into my passive DNS database by reading CT logs and then trying to resolve them.
I'm having the same issue. https://securitytrails.com/ also had my "secret" staging subdomain. I made a catch-all certificate, so the subdomain didn't show up in CT logs. It's still a secret to me how my subdomain ended up in their database.
maybe your server responded to a plain ip addressed request with the real name...
Some may find this more desirable than wildcard certificates and their drawbacks.
This site will find any subdomain, for any domain, so long as it previously had a certificate (ssl/tls) https://crt.sh/
If it is on DNS, it is discoverable. Even if it were not, the message you pasted says outright that they scan the entire IP space, so they could be hitting your server's IP without having a clue there is a subdomain serving your stuff from it.
> If it is on DNS, it is discoverable. In the context of what OP is asking this is not true. DNS zones aren't enumerable - the only way to reliably get the complete contents of the zone is to have the SOA server approve a zone transfer and send the zone file to you. You can ask if a record in that zone exists but as a random user you can't say "hand over all records in this zone". I'd imagine that tools like Cloudfla…
Some CAs (Amazon) allow not publishing to the Certificate Transparency Log. But if you do this, browsers will block the connection by default. Chromium browsers have a policy option to skip this check for selected URLs. See: CertificateTransparencyEnforcementDisabledForURLs. Some may find this more desirable than wildcard certificates and their drawbacks.
Why?
Earlier quoted context omitted.
Port scanning usually can't discover subdomains. Most servers don't expose the of the domains they server content for. In case of HTTP they usually only serve the subdomain content if the Host: request-header includes it.
I could be wrong, but the Palo Alto scanner says it's using global ipv4 space, so not using DNS at all. So actually the subdomain has not been discovered at all.