Hacker News Reader

Comment by chatmasta | Hacker News Reader

This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone.

I wonder -- has anyone written code to spin up EC2 instances and check for subdomains pointing to the IP? Not sure how you could do that efficiently (does rdns work after the IP has been recycled?), but a starting point might be gathering as many NXDOMAIN subdomains as possible, filtering the ones at cloud providers, and starting instances until you get a match.

View on HN

Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70

If you're fast enough, it could still be cached in bing when you search.

That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.

Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.

Is it a private server? It might be a shared host so that many domains are pointing to the same IP.

Yes, private server with dedicated IP.

https://api.hackertarget.com/reverseiplookup/?q=208.109.192....

Try passing 1.1.1.1 if you want a no-js version of the infinitely scrolling website.

That’s pretty cool. They must be buffering output themselves and sending raw http responses over the socket.

I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool.

As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.

Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP.

Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.

We didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person.

There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.

Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.

Definitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.

It's comparable to using an RBL that excludes dynamic IP clients. The difference is one of culpability IMO, where the dynamic IP clients are likely to be innocents with compromised boxes but these cloud instance spammers are actively hostile (insofar as spammers are hostile)

I think I experienced this.

Received an email from campus IT that my phone was compromised.

On further digging I would load up a game every once in a while on the campus wireless. That game used a popular/legit Chinese CDN to host something on their news page which was flagged.

Easier to just use my wireless phone package instead of explaining my phone wasn't compromised.

Then it's not a shiny new IP; it's a tarnished used IP that hasn't been refurbished.

Which is the only reality on ipv4

I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...

Is it possible for IPv4 to not recycle IPs?

Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)

For IPv4, clearly no, at this point.

For IPv6, clearly yes, at least so far. It's pretty typical to get at least a /64 aka LAN with a VPS. That's 18 x 10^18 addresses. ISP customers typically get a /56 (256 LANs) or a /48 (65536 LANs).

Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.

I believe https://securitytrails.com/ is a new player in this space

I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs

https://gist.github.com/rxall/5305bcaa008e51685998

> Not sure how you could do that efficiently...

You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time.

RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.

GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.

I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec.

https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...

Should be simple. Just log 'host' header from http terminations, right?

Reply on news.ycombinator.com