Subdomain Takeover

The talk explains how DNS records route a hostname either to another hostname (a CNAME) or to an IP address (an A record). When a cloud resource is torn down but the record pointing to it remains, the name is left dangling, and anyone who claims that resource name can take over the subdomain. The speaker notes that most guidance covers CNAMEs, while A records can be vulnerable too.

The risks covered include phishing from a trusted domain, defacement, and malware delivered under a legitimate-looking link. Cookie exposure depends on broad domain attributes, which matter most in certain single sign-on setups. Taken-over hosts that serve scripts can enable cross-site scripting, especially where a content security policy allowlists that subdomain. The fix is mainly DNS hygiene: removing records for resources you no longer own.

Open-source DNS Reaper handles CNAME detection well, but it does not cover A records. The speaker's approach compares public IP addresses in DNS against those in the cloud inventory, flagging records that point to cloud addresses the organization no longer owns. A daily job runs both checks and posts alerts to chat. Prevention includes removing DNS records before their targets, and using CAA records to restrict certificate issuance. Validating existing exposure is hard, and the speaker sees little built-in provider support.