Hello, everyone, and welcome to this video.
So in this video, we are going to discuss about a very, very awesome resource, which is can I takeover
XYZ now
What is this?
So it is a complete comprehensive guide for the subdomain because they are very, very useful resource
which has been available and which has been used by many security researchers to identify some domain
takeover based vulnerabilities.
So what exactly is can I take over xyz it contains a list of services and how you can claim
the domains as well as the subdomains with dangling DNS records, which basically means the DNS records,
which are being pointed to these cloud platforms.
But are never claimed and we as security researchers can easily claim those subdomains or the dangling
DNS record and claim the subdomain as well.
So this comprehensive guide of subdomain takeover's contained in 58 fingerprints of different cloud
services, which you can easily take over and prove subdomain takeover based vulnerabilities or flaws.
Now, there are few points to know and remember about this.
Can I take over XYZ comprehensive guide.
The first one is it contains the rich and refined list of services that are running on cloud platforms.
The second point is identification of dangling CName.
So we are going to identify the vulnerable DNS records that have been written and has been pointed to
these cloud services.
And the third one is the list of fingerprints and the status of takeover that we are going to perform.
So we are going to utilize the fingerprint from this resource and we are going to match and identify
on many subdomains.
If these fingerprints match, then we can successfully claim a subdomain takeover over their.
So now it is a practical time and let's see, how does this look like and how can we utilize it for
our benefit of subdomain
Takeover's.As you can see over here
This is a repository by Edoverflow in which you can see over here, can it takeover xyz
Now, first of all, what is subdomain take-over?
You guys are already aware about subdomain take over based vulnerability.
So let me just come to all entries, which contains the fingerprint of all the cloud services.
As you can see here, the engine, the engine stands for the type of subdomain or the type of cloud
service, the status, if it is venerable or not, the fingerprint that you need to check into the response
for that particular subdomain.
That discussion contains the discussion of the issues that have been opened by other security researchers,
which also contains sometimes the steps of taking over any subdomain.
And if it is not possible to take over the subdomain, it is also mentioned into the ISSUES section.
The documentation contains the documentation about the cloud platform and how the subdomain takeover's
can be possible.
All right.
So starting with the first one, as you can see, the first one is Acquia, which is not vulnerable,
and the fingerprint is a website not found.
Now, if the status is not vulnerable that means that particular cloud service provider cannot
be done.
A subdomain takeover, which means you cannot takeover those subdomains which are being hosted by this
platform, which is Acquia.
But if you see the second one, which is agile CRM, then it is vulnerable and you will be able to see
a message which says, sorry, this page is no longer available into the response of that subdomain.
All right.
So let me show you one of the example for one of the cloud service provider.
So let's say we see for Heroku and you you can see the cloud service provider is Heroku.
It is an edge case and the fingerprint is no such app.
Now, what is Edge case?
It should be vulnerable or not vulnerable.
Now, edge case means that sometimes you will be able to claim those subdomains and it becomes vulnerable
and sometimes you are not able to do it.
Now, why this?
Because the cloud service providers have put on some medications or some settings in which a few of
the subdomains are not able to successfully get claimed by us, and in some cases we can claim it.
So it is considered as an edge case for all the edge cases.
You should at least try once to claim the subdomain, and if you are able to do it, then it can be
a vulnerable subdomain.
Take over and you can report to the target organization for this.
We are going to utilize censys.
So as soon as I come on Censys, you can see a search box over here.
You just need to type the fingerprint name.
The fingerprint name, as we saw, was no such app.
So I need to copy and paste it over here and.
Right.
Heroku in front of it.
Now, what this basically means is Censys has already crawled all the target addresses, Web servers
and has its fingerprint saved into its database.
So we are quering the database from the Censys to all the Web servers, which contains these fingerprints
to match a subdomain takeover vulnerability of Heroku.
So this becomes very, very simple and easy for us to identify those target domains or subdomain which are
Hosted on Heroku but never claimed on Heroku all right.
So you can see there are a couple of IP addresses that we have identified.
So by opening each one by way, you can see over here, these are the targets that I have identified
from Censys.
And you can see a message which says, no, such a app over here, as you can see, and this is being
served by Heroku.
Now, this domains are these subdomains becomes automatically vulnerable to subdomain takeover's.
Oh, you can report it to the target organisation.
So this was one of the easiest way of using can I takeover XYZ to identify the fingerprint
And also, you can use Censys to just identify if any targets are vulnerable to subdomains takeovers.
And in a similar way, you can use different methods for like subdomain enumeration and from those of
domain enumeration assets or targets that you have identified, you can test subdomains takeover based
vulnerabilities.
So I hope you guys understood.
Thank you.