Presented at
CactusCon 12 (2024),
Feb. 16, 2024, 9:30 a.m.
(30 minutes).
Most of my cybersecurity experience is in the application security space. I've managed bug bounty programs, done web application security consulting, and built code-scanning programs that integrate into CI/CD pipelines. One problems that stands out in application and cloud security is the issue of Subdomain Takeovers. These are an issue all companies with cloud-based infrastructure share. If you have publicly accessible resources that are hosted in the cloud (AWS, AZURE, GCP, etc), then you are likely (hopefully) dealing with Subdomain Takeovers in some capacity. I'd like to cover what a Subdomain Takeover is, the dangers that it can pose to an organization, and what you can do to detect subdomain takeovers. Many tools, scripts, and articles talk about the dangers of dangling CNAME records, but few mention that A Records can also be vulnerable. I have developed some automation at my company that checks daily for potential subdomain takeovers, CNAME and A Record, and sends us alerts when it discovers vulnerable records. I would like to share how one could implement something similar and what their automation/script might look like.
Presenters:
-
Anthony Pipia
- Application Security Engineer
Application Security Engineer and Consultant. OSCP Certified hacker. Breaking into Information Security in a vulnerability management field, Anthony has always have an inclination for automation. With a passion for offensive security and web application testing, he moved into the application security space. Some of his more prominent accomplishments include building and supporting Security Champion programs, Code Scanning (SAST/DAST/SCA) programs, and performing web application security assessments. He enjoys writing python code and has jumped at every opportunity to write automation to improve processes in the security organization. With a passion for teaching, he also instructed a 24-week Cybersecurity Bootcamp alongside his full time job. His hobbies include video games, hiking when it's not too hot, and traveling.
Links:
Similar Presentations: