Anatomy of a CNAME Hijacking
A subdomain takeover occurs when a DNS record points to an external resource (like an AWS S3 bucket, GitHub Pages, or Zendesk) that has been deleted, but the DNS record remains active.
How a Takeover Happens
1. DNS Setup: An organization sets a DNS record: docs.example.com CNAME example-bucket.s3.amazonaws.com.
2. Resource Decommission: The organization deletes the AWS S3 bucket example-bucket, but forgets to delete the CNAME record from its DNS zone.
3. Attack Vector: An attacker discovers that querying docs.example.com returns a "NoSuchBucket" error.
4. Exploitation: The attacker registers their own S3 bucket named example-bucket. They now control the content served at docs.example.com.
Consequences
- Phishing Campaigns: Attackers can host phishing forms on a trusted company subdomain.
- Session Hijacking: Attackers can read session cookies scoped to
*.example.comsent by the victim's browser. - Bypassing Content Security Policies (CSP): Many CSP rules trust the organization's own subdomains, allowing the hijacked subdomain to bypass script restrictions.