The vulnerability we will be talking about in this chapter is so tricky that it is more like a configuration management error than a vulnerability. However, there are bounty platforms, such as HackerOne, that include it as vulnerability, so it's still worth discussing.
The problem in this case arises when someone registers a new domain to point to another domain. So, we will cover the following topics in the chapter:
- Sub-domain takeovers
- Internet-wide scans
In a vulnerability example, the sub domain (hello.domain.com) uses a canoninal name (CNAME) record to point to fulanito.com. A CNAME record is a domain name service (DNS) register, and it allows us to specify an alias for a domain name to a user. For example, if we have the Mexican domain, mitiendita.com.mx, we can create a CNAME register to point it to mitiendita.com.cl using the...
