Collaborate Disseminate
For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt’s ACME script to successfully validate my domain and produce an ssl certificate for a subdomain. I setup my pfsense to use… Continue reading How does DNS-01 validation for LetsEncrypt know what the right IP address is?
I’m reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia.
On the subject of DNS cache poisoning, they mention that a "new" attack was discovered in 2008, … Continue reading Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?
I don’t have much experience in buying and installing ssl certificates.
I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to protect this one website.
xxxxx.com itself… Continue reading Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]
Sublist3r and Subfinder are the two most popular tools among Bug Hunters. According to the power of finding subdomains, which tool is better?
I have found links to an obvious bait website. Link to PHISHING website. However, I was very surprised to see the domain is "holidayinn.com". On first sight this appears to be a genuine subdomain. How is this possible?
EDIT: An e… Continue reading Phishing/spam websites using the same domain as legitimate websites?
I was working on a rule that reports phishing sites, and I wanted to exclude known domains, such as .microsoft.com etc, and a doubt arose: can someone register a subdomain of a known site to phishing purposes? I came across this article, w… Continue reading Can subdomains of trusted domains be registered for malicious use?
I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be like subdomain.mainwebhost.com
If on Subdo… Continue reading Can attack to a website from a parked subdomain with different hosts?
How do I use subjack?
I have it under go/bin/subjack but what’s the next step? The github doesn’t say. When I go in the bin directory and output
./subjack -d example.comnothing happens.
What do I do?
Continue reading Subjack – Sub domain takeover tool [closed]
I try to automate a solution to check hosts for Subdomain takeover vuln. First I get all subdomain’s responses, then use the loop to checking keywords:
if grep -l ‘Repository not found\|The specified bucket does not exist\|Github Pages sit… Continue reading Filtering http responses for subdomain takeover
Recently, I started diving into cookies, but as far as the domain property is concerned I don’t think it is straightforward.
I read this article:
http://web.archive.org/web/20200418163316/https://www.mxsasha.eu/blog/2014/03/04/definitive-g… Continue reading Cookie domain security