Unsecured subdomains can present severe risks to your business.
10:35 28 August 2019
Categories :Business-money Internet of things
More and more hackers target subdomains to get into the infrastructures of companies and disrupt them.
The most recent case has been with the platform Vine, the short-video based entertainment network. An Indian security researcher found the entire code for the platform hiding in plain sight and was able to download it. He handed over the information to the Twitter company, who awarded him $10,000 as a bug bounty.
If you are a website owner or a security engineer, you don’t want this to happen to you. Therefore, knowing how to find subdomains can save your job. To avoid such attacks, use the following tools and methods to control your subdomains and observe subdomains of other companies.
Finding Subdomains: Popular Methods in Modern Infosec
There is a tool called the subdomain scanner, which features various utilities to help you explore the full domain infrastructure of any company in the world. These subdomain enumeration toolkits are very popular in use:
DNS audit:
Performing a scheduled DNS audit is one of those things security engineers skip like a software update. However, with the increasing number of DNS attacks in the media, it is very much recommended to do it. Running a DNS audit helps you update stale DNS records, find unused subdomains and expired SSL certificates or exposed legacy software.
Considering how often we see DNS attacks, it’s essential to run the audits as it will help harden your systems and applications. It will also update your server and network infrastructure documentation, making you significantly harder to target for a potential attack.
Vulnerability Scanning:
To find subdomains can bring remarkable discoveries about any company online. Subdomain lookup can reveal priceless hidden information, development areas, applications yet to be protected and various private company information.
Upon amassing this information, it can be thoroughly scanned for vulnerabilities and exposed or protected.
Terminal-based Subdomain Scanners
Spyse.py
Another helpful way of finding subdomains is by using the terminal-based subdomain scanners. The one we’re looking at is Spyse.py. This is a python-based tool, and the AAPI wrapper and command-line client for the tools hosted on spyse.com. It supports 6 more API’s of other tools made by Spyse.
Knock
Knock is an alternative Python subdomain scanner that helps infuse researches gather valuable intel. What Knock does is it performs a full DNS zone transfer. If it goes south, Knock runs a query against the VirusTotal database of subdomains.
This program does a fantastic job when you need to find subdomains of a domain.
And still, using these terminal-based scanners can be time-consuming and not very comfortable for people with limited knowledge in the field. You will also have to spend some time to structure the information. Therefore it’s much more convenient to use online subdomain finders.
Online Subdomains Finding Tools
Online subdomain scanners are probably the quickest and most efficient way to explore subdomains. The new tool on the market, FindSubdomains, is ultimately the fastest way to perform daily reconnaissance on subs. The tool collects broad data using a self-developed subdomain finder and stores it in a database. That means when you ask it to find all subdomains of a domain, you don’t have to wait. The app has already done it and structured the data so you can access it conveniently at any time. And in addition to that after you found all the subdomains of a domain, you will also get such info as IP numbers, Geo, and AS numbers.
The Spyse ecosystem presents six more tools like FindSubdomains, which run quicker and more efficiently than the old school tools.
How To Use The Collected Information
The question is — why would somebody need this information about a domain and all of its subdomains? Well, ask your security engineers how handy it is.
Security Engineers
To make your security engineer happy and working, give them the subdomain finder. It will help them:
- Identify areas of the attack for further investigation
- Identify security gaps and weaknesses
- Prevent data leaks
Pen-testers
This tool helps pentesters to do the following things:
- Check the endpoints of vulnerabilities
- Find unprotected subdomains
- Find subdomains that are at an early development stage
- Perform all this in record time
System Administrators
Admins need a birds-eye-view of the system to keep it updated and safe. This tool will help them:
- Optimize the network infrastructure
- Respond to threats quicker
- Find unsecured subdomains
- Find technical domains that can be attacked
Business Analysts
For business analysts, this tool is pure gold. It completely exposes the competition and all their plans in development. Use the tool to:
- Conduct full competitor analysis
- Foresee changes and developments in the business
- Look for open subdomains of competitors
Conclusion
Either you are a cybersecurity expert or a business owner make sure to use the best tools to ensure the security of your company or the company you are working foк. Otherwise, it might cost you lots of money, and competitors will track your subdomain changes and try to outsmart you.
Considering how many DNS attacks there have been in the past month alone, subdomains are an open field of experimentation for hackers. Thankfully with the help of tools like FindSubdomains, protecting a company’s network infrastructure is made significantly simpler than before.
)
