subjack

subjack copied to clipboard

So far all the Azure takeovers i've found that resolve to *.trafficmanager.net seem to be FP thanks

Thank you @AnotherWayIn I started noticing this a while back. I haven't found a proper way to remediate this issue, it seems the only way to rule out a false positive would be to attempt a takeover.

@haccer if it resolves to an IP it's taken the only other way i know is to to use the Azure CLI as it requires auth to check if the subdomain is available.

@random-robbie

basically how the azure domains are found are basically similar to:

➜  ~ host azure.cody.su
Host azure.cody.su not found: 3(NXDOMAIN)
➜  ~ dig +short cname azure.cody.su
alskdjfl.trafficmanager.net.

The detection goes as:

If subdomain has trafficmanager.net cname && not pointing to any IP {
  subdomain == takeoverable
}

You're right, Azure CLI integration is an option, or if they have an API that is also another option.

For anyone reading this, if you want to resolve this issue and submit a pull request you are welcome to do so.