Hello, everyone.
And now, as we have completed the installation for Sublister, we are going to run this into our target
domain.
So let's see, my target domain is srsecure.xyz.
Then you need to supply the hyphen.
d flag, which stands for the domain name, and I will hit enter.
As you can see it is enumerating the subdomains for the target that you have supplied.
You can give any target that you want, it can be uber PayPal, Google, Facebook, anything, and
it will start searching into Baidu, Yahoo, Google, bing ask net craft and different types of search
engines or DNS crawlers.
So basically how Sublister works is it tries to collect all the subdomains which are being stored by these
different services like Baidu, Yahoo, Google, etc..
In a couple of seconds, it is going to identify and give us the number of subdomains that are being
made for srsecure.xyz
And this way you will be able to identify all the subdomains.
Now, as this tool is running.
I have already run,one of the instance and here is the output, how it will look like.
So let me just show you and you can see we have identified in total 56 subdomains for that specific
target.
And you can see the subdomains looks something like this, which is anil. srsecure.xyz
Sounds like your apple. srsecure.xyz and beta. srsecure.xyz.
And you can see there are a lot of subdomains which are being made over here.
Now, let's try to see if we get the subdomain that I have created recently, which is shifaShopify
srsecure and you can see over here, it has still not been populated.
This is because the DNS crawler has not still called the new subdomain.
This is usual and it may take some time for new subdomains to get crawled and appear in the search results.
So we should give this some specific time.
And in about 30 minutes, we will be able to see the results into the subdomain enumeration that we
are doing.
So this has completed again over here and we are not able to see the new subdomain because it has been
just published by me five or 10 minutes ago and it would take some time to get populated into these
scans.
All right.
So after you have identified the subdomains from these scans now, what is the next step that we are
going to do?
So let me just clear my screen and let me try to ping the subdomain that we have identified.
So we have identified the subdomain, which is shifashopify.srsecure.xyz
And we are going to ping this to check if this subdomain exists or does not exist.
And you can see we are getting a reply from that specific subdomain.
And you can notice over here the IP address from which we are getting the reply is this.
So let's try to identify to whom this IP address belongs to.
So I'm going to simply who is on this IP address?
And we already know this IP address belongs to Shopify Operations which is Shopify organization now.
What are the next steps that we should do so we are going to just open up a new tab and try to open
the subdomain that we have just identified.
And when I opened this particular subdomain, it looks something like this and the message says only
one step left to finish setting up your new Web address, go to your domain settings, click connect
existing domain and enter shifashopify.
srsecure.xyz
Perfect.
Now you have to remember, whenever you will be able to identify those particular subdomains which are
vulnerable to subdomain take-over.
For Shopify specifically, this is one of the fingerprint which you are going to see everywhere.
By fingerprint, I mean you're going to see the same message everywhere.
And remember our memories for Shopify, you will see the message, which is only one step left.
This is important because there are so many fingerprints or patterns for different types of cloud providers.
And this is the specific message for Shopify.
All right.
Now, as we have identified the vulnerable subdomain and we have seen, how does it look like when you
stumble upon any subdomain, which is pointed to Shopify but is not being claimed now
We are going to claim this as an attacker and we are going to own the whole subdomain through which
any attacker can host any malicious content onto this sub domain and customers can get redirected to
this sub domain and.
The attacker may host some of the malicious content and steal sensitive information from the users or
the customers.
Now, how do we clean this subdomain?
So first thing that you need to do is quickly sign up for Shopify so you will be redirected to the original
Shopify dot com page.
You just need to click here and get started.
And Shopify offers you a 14 day trial.
This is one of the best thing.
This means that you do not need to pay anything for proving subdomain take-over vulnerabilities and
you will be able to make a PoC free of cost.
All right.
So let's quickly given the email address.
So let's use one of the e-mail address for this attack.
I'm going to choose an e-mail address for this attack, which is, let's say.
hacker.udemy
One.
@Gmail dot com and password, which was a password, let's say the store name we are going to
give as Shifa.
Shopify subdomain take-over.
OK, so it is say store name can't contain the word Shopify, no issues, so let me just remove that and
shifa subdomain take over and let me create a store.
As you can see over here, it is creating the store and moving ahead with some of the steps, let's
wait for this to complete and.
Once we are inside this, we will be able to do the next quick steps.
One thing that you can quickly notice over here is that we have got one of the domain like this, which
is our store name, which is shifa Subdomain takeover my Shopify dot com.
All right.
So it will ask you some of the questions.
We can just simply skip those.
But you need to add the last step, which is an address.
So let me just give some of the details.
So let's say I give them details as Rohit.
Gautam address.
Let me give us Mumbai.
Let me give as Mumbai again over here, Mumbai country, India, state Maharastra, Pincode.
Let me give this let me see if I can keep this blank and enter the store.
OK, so it is asking for a phone number.
So let me give.
My phone number and enter the store.
All right, so once you have given all the necessary details, we will be able to come on to our account.
And now this is the page from where we can do the next quick steps to perform a successful subdomain
take over.
All right.
So now over here, you can see we just need to click on this particular button, which is add domain.
And remember, what was the subdomain?
That was vulnerable it was Shifa.
Shopify.srsecure.xyz
Yes, this is the one which was vulnerable.
Now I just need to click on Add Domain and over here, as you can see, this is my primary domain through
which I have created account.
I just simply need to click on Connect Existing Domain.
And over here I can give the domain name.
Remember, you can remove this extra https and slash and you can just hit on next.
Once you hit on next, it is going to say you you need to connect your namecheap domain.
This is because the srsecure main domain is provided by the service provider, which is name
cheap.
All right.
So we don't need to do anything.
We just need to click on Verify Connection.
Once we have clicked on Verify Connection, it is going to take just a couple of seconds.
And after that, we will be able to claim successfully the domain and once we have claimed it.
As you can see over here, we have claimed it successfully and now we can find anything or upload anything
onto this particular domain.
As you can see, it says status connected, SSL pending.
It will automatically even put SSL certificate free of cost over there.
Now, let's verify what happens when we go over there.
Are we able to see the same fingerprint or not?
So let me just paste it over here and let's see what do we get?
Perfect.
As you can see over here, we are able to see shifa subdomain take over.
The coming soon is because we have not created a website right now, but we are able to claim this particular
page and I can host any application that I want over here, change to theme, change the content and
put anything over here so you can see and notice the comparison between the fingerprints that get changed
before it was something like this which says only one step left because this subdomain was vulnerable.
Now, the attacker has successfully claimed this subdomain by creating a successful account on Shopify
and claiming the particular subdomain, he can upload anything onto this particular subdomain which
will be served to the users.
So I hope you guys understood how you can successfully do Shopify subdomain take over.
Thank you.