Summary
Patrick Hudak demonstrated possible subdomain takeover using the Traffic Manager in Azure.
Affected Services
Traffic Manager
Remediation
Review your DNS zones and identify CNAME records that are dangling or have been taken over.
For further recommendations, review Microsoft's article on subdomain takeovers (linked in references).
Tracked CVEs
No tracked CVEs
References
https://0xpatrik.com/subdomain-takeover-starbucks-ii/https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Fri, Aug 10th, 2018
Exploitablity Period
ongoing
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Patrick Hudak
