How To Reveal Hidden Subdomains To Reveal Internal Services With CT Exposer «Null Byte :: WonderHowTo

If you follow the subdomain breadcrumbs, you can still discover subdomains where the DNS is resolved becomes . Another example, h.priceline.com which leads to an insecure website with a very old copyright date. The site talks about a number of services that they either no longer offer or offer.

Similarly solves media.priceline.com Actually, this time on a secure website that uses HTTPS for press like me, but also last updated in 2014. I'm sure nothing has changed since then.

In some cases, the security of the transport layer is broken and you receive a big warning like follows when trying to resolve picme.priceline.com for example.

If you ignore it and continue, you can see that the whole server is broken, resulting in an error message with m ore information about it. (Gee, thanks for the unnecessary information.)

As you can see, there is an Apache 2.4.18 server on an Ubuntu on port 443. Hmm that seems to be old somehow. Go ahead and google that exactly to see if something could be wrong. Surely, the fortress of information priceline.com can not expose an old, vulnerable server to the Internet.

Oh my god. There are 16 different vulnerabilities. In that case, you could just keep going, assuming it's so riddled with problems that it's probably a honey pot. Would not you feel bad?

Finally, there is the crown jewel of discovery: employee login and application endpoints! Learn more about the safety of your destinations and try to get passwords in these waterholes. For example, if you try to resolve phantom.corp.priceline.com the following page prompts you to request a logon.

So, does that mean that Priceline operates a Phantom Corporation? It may be so, but in fact these are only endpoints for things like email, hotel logins, and other services accessed by people outside the Priceline network.

Here are the two important things you can learn that priceline uses okta.com for authentication and requires two-factor authentication through "duo" security.

If I'm an attacker, I now know that employees receive a push notification every time they log in to a corporate resource on a new device. This means that the collection of usernames and passwords is useless without this authentication layer being detected as well.

You may also have multiple domains without a DNS record. This means that you can not navigate to them because there is no route known on the public Internet. What does that mean?

  [+]: Domains without DNS entry:
no en.hotelportal.priceline.com
no fs.corp.priceline.com
no pcln04.corp.priceline.com
no rsecure.priceline.com
none secure.priceline.com 

This means that they are serviced by an internal DNS server or that you need to be logged in to access a VPN. This makes these subdomains the most interesting in the world because they are internal attack surfaces to which you do not yet have access. They also serve as targeting information for your first attacks and a way to persuade employees to be on a private network if they are truly public.

What a hacker might learn from that is that Recon is a critical skill that does not have to be an enormously time-consuming endeavor. While CT imagesetters should be just one tool in your arsenal, it's relatively easy to get to know the structure of a company's online presence before choosing the perfect target.