Subdomain Takeover

Hanno Böck

hboeck.de @hanno

curl http://dev.tnm.teams.microsoft.com/

Why do I control a subdomain of microsoft.com?

Subdomain Takeover

The Cloud

Let's start a project in the cloud

  • Create webpage at cloud service (Azure, AWS, GCP).
  • Redirect subdomain of your company domain to cloud service (e.g. CNAME).

Let's shutdown a project in the cloud

  • Cancel webpage at cloud service (it costs money!)
  • Forget about DNS entry (it's usually free)
  • Hacker re-registers webpage at cloud service.
  • Fun!
Video

tl;dr

Don't have stale DNS entries laying around