liveBook · Manning

Subdomain takeover

As explained in Azure Security

A subdomain takeover is an attack in which an abandoned or deleted resource referenced by a subdomain is claimed and used to control traffic for that subdomain.

A subdomain takeover occurs when a DNS record still points to a deleted Azure resource and an attacker claims the resource's former fully qualified domain name. The attacker can then redirect traffic intended for your subdomain to malicious content, including phishing or credential-harvesting sites. section 4.5.3

Prevent the dangling-DNS condition by following the resource lifecycle:

  • Remove DNS records that point to Azure resources when those resources are deleted or deprovisioned. section 4.10
  • Treat retained records as active advertisements: they may continue routing a subdomain even though the original Azure resource no longer exists. section 4.5.3
  • Review resource deletion procedures for Azure App Service workloads and other frequently created or deleted Azure resources. section 4.5.3

Dangling DNS in action

An application uses app-bestwebapp-dev-001.azurewebsites.net and the subdomain bestwebapp.mycompany.com. After the Azure resource is deleted, the DNS record remains. An attacker can provision an Azure resource with the same fully qualified domain name under another subscription, causing traffic for bestwebapp.mycompany.com to reach the attacker's resource. section 4.5.3

How Azure Security covers it

How deep it goes
Traces dangling DNS through resource deletion, FQDN reassignment, and traffic redirection, without detailing automated detection or response.
Examples
Uses an Azure App Service hostname, a custom subdomain, a deleted resource, and an attacker-provisioned replacement.
What it assumes
Assumes familiarity with DNS zones and Azure resources while defining dangling DNS and fully qualified domain names through an example.
What you can do after
Operate Azure resource lifecycles safely by removing DNS records when their referenced resources are deprovisioned.
How it connects
Connects DNS, Azure resources, Azure App Service, fully qualified domain names, phishing, and credential harvesting.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.