Preventing Subdomain Takeover /w OWASP Domain Protect
summary
OWASP Domain Protect scans Route 53 Cloudflare and GCP DNS, writes findings to DynamoDB and notifies via SNS/Slack, and deploys with Terraform and GitHub Actions. It runs as serverless Lambda orchestration every ~10 minutes, performs automated friendly takeovers of S3 and Elastic Beanstalk when resources are dangling, and integrates with HackerOne/Bugcrowd. First-year results show ~200 vulnerable subdomains found, about half caught by Domain Protect and a quarter by the GCP module, and the automated takeovers prevent many payouts.
AI-written summary · about
chapters (12)
- 0:00Subdomain takeover risks
- 6:41Dangling DNS in AWS
- 19:05Dangling DNS takeover
- 22:18OVO Energy bug bounty
- 25:53OWASP Domain Protect
- 28:46Domain Protect serverless
- 33:27Alerts and reporting
- 38:27Automated takeover detection
- 42:41Results and features
- 46:13Live demo
- 49:07Next steps and contribution
- 50:10Q&A
related talks
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
38mCloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets
28mFerris Bueller's Guide to Abuse Domain Permutations
33mHow to implement DDoS protection in GCP
01h 01mDefendable Products: How we try to improve security in our products
39mAutomated Cloud Security
40mDid Subdomain Abuse by BlackTech “Evolve”?
39mProject Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale