Hello, everyone, and welcome to this video.
In this video, we are going to see a subdomain takeover for a very, very famous online cloud platform,
which is a A.W.S. for those of you who does not know what it stands for.
It is Amazon Web Services, one of the biggest platforms that has taken over multiple cloud platforms.
Then Azure and Google hosted cloud platforms as well.
Now, as people have increased and shifted to these cloud platforms to a majority of percentage, the
chances are that they may arise some of the security configurations.
So a higher number of people migrating to these particular cloud platforms, the higher number of chances
of some of the security issues that attacker can compromise, or for bug bounty hunters like us, we
can at least take benefit of that in identifying the vulnerability and helping the company to fix it
and getting a reward in return.
All right, so here we are going to identify those particular subdomains, which are pointing to AWS
platform, and we are going to identify that once we have identified, we're going to take over those
particular subdomains by creating A.W.S. account and then taking up that particular bucket.
All right.
Enough of talking.
Let's quickly see how can we do this attack and take over A.W.S. based subdomains.
So it is the practical name and let's see how to do this.
So, for example, over here, I have taken over one of the subdomain of kippt dot com.
This particular program is an acquisition of Krunch Base.
I'm sorry, it's Coinbase.
So this particular program is an acquisition of Coinbase.
I have identified all the subdomains for this particular target program and there is a subdomain which
is uploads, dot kippt dot com, which I have seen.
Is something wrong with this particular subdomain
As you can see, you would hear the fingerprint is no such Bucket.
This is the fingerprint for AWS types of subdomain takeover's.
Do you remember in the previous videos for Shopify we have seen the subdomain take our fingerprint and
fingerprint was only one step left.
But for AWS based fingerprints or AWS based subdomain takeover's, you need to see the fingerprint,
which is no such bucket.
The specified bucket does not exist.
All right.
So we have completed the first step that is identifying a venerable subdomain after this subdomain enumeration.
But now, as we have identified this subdomain to be vulnerable, we are going to do a successful takeover.
As you can see, I have shown over the here that keppt is acquired by Coinbase.
For this, I am using the platform, which is crunchbase to identify the acquisitions for target organizations.
All right.
Now, the first step that we have to do is we have to go on to AWS and create a free account.
So whenever you create account on AWS you have the complimentary free access for one year until
that you are not going to get charged for anything.
But when you are making an account on AWS is just for their security reasons, they ask your card.
So you need to add your credit card with them and after verification, your account will be activated.
It may take a few hours.
It took me six to seven hours for verification of my account and after that I was able to use my account
with no issues.
All right, so once you have created your AWS account, you will get one year of free membership to
use this particular account.
After you have verified you need to login into your account and over there you will be able to see your
option, which is S3 bucket.
So you just need to click on S3 Bucket.
And as you can see over here, you will come to the bucket section over there.
You need to click on this particular blue button, which is create bucket.
As you can see over here, once you click on Create Bucket, it will give you a pop up like this where
it is going to ask you to fill some of the details.
And you need to complete this mandatory four steps, which is name and region configure options, permissions
and finally review your settings that what you have done to make it much more simple.
Let's quickly see what you need to do and which are some of the configurations which can be left blank.
All right.
So here you need to put the bucket name, which is the subdomain.
You want to perform the takeover.
It's pretty simple.
Now, the most important thing is to choose the region.
Now, you should know that on a AWS, the bucket which are made are independent of a region.
OK, why am I telling this?
Because this is going to get handy and you should know this because whenever you make any bucket so
let's say I'm going to take this particular bucket, which is upload dot keppt dot com and I have to
choose the right region.
If I do not choose the right region, then I will get the error that the bucket is hosted, but it is
hosted at the incorrect end point.
Hence we cannot run the website or basically whatever you put onto this subdomain will not be visible
to public.
So for that, you need to choose a right region, which is a very, very important and mandatory step.
Now, you may ask, how are we going to know the region for this particular subdomain?
It's pretty simple.
So for that, you just need to go to your terminal.
And over here you have to type the command, which is Dig.
And you need to check the name of your subdomain, as you can see, the C name of this particular subdomain
is S3 dot Amazon AWS dot com.
This basically means the particular subdomain is pointing to AWS account or AWS platform.
All right.
So we know it is pointing to Amazon AWSand S3 bucket.
Now, what are the next steps that we should do in the next steps?
We are going to identify the region for that particular subdomain.
So now what I'm going to do is I'm going to type the command nslook up and I'm going to type.
Uploads.kippt.com, and here you can verify the Cname is again, s3.amazonaws.com.
All right, so we know it is hosted in S3 Amazon AWS but still we have not got the correct
region.
Now, what should we do to get the region?
So we are going to again hit Dig for any other subdomain of that target organization.
So I'm going to hit Dig Cname for an addons.kippt.com.
and let's see if we get the region, perfect.
As you can see, we have got the region for this particular subdomain and you can see it is keppt addons
dot s3 website hyphen us, hyphen east hyphen one dot Amazon AWS as dot com.
So one thing to notice over here, the region is US east-1.
Well let's go over here and identify us east one now and then you will choose us east one you should
know what is the region name because region name will not be shown over there.
So the code is this the region name is this.
So you have to choose North Virginia.
Now, how will you know this?
This is from the AWB Official Documentation Guide.
You will come to know that what is the code for which region?
So from this guide, we have identified that southeast US E1 is North Virginia.
Now you can copy settings from what the market if you have already hosted in your pocket, if you have
not hosted any bucket, just leave this option blank and hit next and you will be able to create your
bucket.
Now, as you can see over here, you need to disable or block all public access may result in pocket
and objects within within becoming public.
So basically, you want to disable this block all public access and we want to make our buckets publicly
accessible.
All right.
So just hit next and create a bucket.
And we are done with creating a bucket.
If you do not get any error and you're able to successfully make a bucket, which means your work is
done.
Now, over here, you can see when you will click on your bucket name, it is uploads that Kim Dotcom,
you just need to come on properties and you need to click on stetting website hosting.
So once you have clicked on Statik, a website hosting there, you need to give a redirect, which we
are going to see in the next steps.
First, let's upload a file over here.
So let's say I'm going to upload RBOC file, which says Subdomain takeover by.
So I'm going to upload this file and you just need to click next and give permission, which is grand
public read access to the objects once they have done this trip next and hit upload.
It will take a few seconds and you can notice all your success and the file has been successfully uploaded.
Now you need to click that file and you have to click make public.
So once you again do that public, it will become publicly accessible.
Now, what you can do is you can rename this file as well.
So I'm going to rename this file as Index Ratman, which is basically a good thing to do.
Do not try to make custom names.
Just give the name as in next.
So I'm going to give that name and save this file.
Once I have saved this file, I'm going to again second make public and get on make public so the file
becomes publicly accessible.
Now let's go to Statik website hosting.
And over here, we want to host our website through the bucket that we have created.
So you need to choose the option number two, which is a redirect request, and you need to type the
target bucket or domain name.
So the domain name that we want as uploads, not kept dot com, just put the domain name and the protocol,
whatever you want.
So we are going to use HDB obviously, because there is no SSL certificate installed over there and
I'm going to click on SAVE once we have done this.
Let's go back to overview and you can see there are no changes over here.
So this was the most important change that you need to do.
That is a static website hosting.
Once I click over here, then you will see the object you are.
Well, let me click on the object.
You all object your shows S3 Amazon, Arabella's dot com slash the bucket name, which is upload that
Kim Dotcom.
And there is a file into this bucket, which is Index Dot XHTML which says this is a subdomain take
over post.
All right.
But we don't want our you order something like this because this is an object.
You are a bucket.
You are.
But we need to show the policy of taking over, upload, start, give dot com.
So what you need to do is you need to come back to this page and you just need to give the reference
of the file that you have uploaded.
So file that we uploaded was indexed at XHTML.
So let's give the name of that file and try to fetch it and let's see if we have the full control over
the subdomain or not or we were able to successfully take over the subdomain or not.
So let me give the name and hit enter and you can see this is a subdomain take-over PEOC.
Let me just reload it again and you can confirm that we are able to successfully take over this particular
domain.
Yes.
So this was it.
It looks a little bit tricky, but the steps are very, very simple.
And once you do it, it will become very, very simple for you to do it next time.
Now, I hope you guys understood how you can do subdomain takeover's for NWS involvement.
And through this process, you can take over multiple subdomains and you can create multiple buckets.
Remember, there is no restriction on making bucket into a free one year plan.
You can make as many as buckets you want, which means you can make as many as proof of concept that
you want for multiple targets.
I hope you guys understood how to do this.
Thank you.