Hacker News Reader

One time I created a virtual machine on some cloud platform and after checking the traffic logs, found out that Coke had some random disused subdomain pointing to my new IP that was still getting traffic daily.

Does anyone here have an idea of how common this kind of mistake is? Would it be a viable strategy for an attacker to just iterate through VMs on a common service like AWS until one happens to get traffic on an interesting domain?

View on HN

I and many other bug bounty researchers have tools that allocate AWS elastic IPs on a loop, looking for domains that point to them. (You don't get to pick what IP you get, so you just have to pray for a good one!) It is a very profitable way to find vulnerabilities, but AWS detects and bans researchers for this activity.

It's very, very easy to find random domains pointing to AWS IPs, although harder to find ones where the company has a bug bounty program. :)

I recall seeing something similar happening with subdomains and S3 [0] not too long ago, albeit that issue didn't involve DNS.

[0] https://news.ycombinator.com/item?id=28351432

Reply on news.ycombinator.com