Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWS Load Balancer #137

Open
nk9 opened this issue Mar 30, 2020 · 6 comments
Open

AWS Load Balancer #137

nk9 opened this issue Mar 30, 2020 · 6 comments
Labels
not vulnerable Someone has made it very clear that this service is not vulnerable to subdomain takeovers.

Comments

@nk9
Copy link

nk9 commented Mar 30, 2020

Service name

AWS Load Balancer
looks like "region.elb.amazonaws.com" or "elb.region.amazonaws.com"

Proof

The URLs produced when you create a load balancer contain a number which you can't control, like <vw3-production-622849735.us-east-1.elb.amazonaws.com>. Since Amazon assigns that number, you cannot claim an expired domain even if you can claim the "name" (in this case "vw3-production").

Documentation

Configure a Custom Domain Name for Your Classic Load Balancer

@fuomag9
Copy link

fuomag9 commented Aug 28, 2020

So this means that elb cannot be taken over

@bsysop
Copy link

bsysop commented Aug 28, 2020

I had a good theory, created a engine to do it, invested a good time in that, lost 700$ in AWS costs with multiple accounts.
By my calculations it would need 27 years to match with an valid ELB.

Good luck.

@fuomag9
Copy link

fuomag9 commented Aug 28, 2020

I had a good theory, created a engine to do it, invested a good time in that, lost 700$ in AWS costs with multiple accounts.
By my calculations it would need 27 years to match with an valid ELB.

Good luck.

as I tought, elb can't been taken over. ec2 ip address on the other hand tho seem more interesting

@bsysop
Copy link

bsysop commented Aug 29, 2020

I had a good theory, created a engine to do it, invested a good time in that, lost 700$ in AWS costs with multiple accounts.
By my calculations it would need 27 years to match with an valid ELB.
Good luck.

as I tought, elb can't been taken over. ec2 ip address on the other hand tho seem more interesting

Probably, never tried.

@pdelteil
Copy link
Contributor

I had a good theory, created a engine to do it, invested a good time in that, lost 700$ in AWS costs with multiple accounts.
By my calculations it would need 27 years to match with an valid ELB.
Good luck.

as I tought, elb can't been taken over. ec2 ip address on the other hand tho seem more interesting

Probably, never tried.

It was fixed recently. You will only get a set of 4 to 5 IPs when you associate and release the IPs. Before you could iterate until receiving the wanted IP.

@AnotherWayIn
Copy link

I went down the ec2 IP route a year or two back. I created a script that went through all their IP ranges in about 2 weeks. I found that it eventually it started giving me the same IPs again without giving me any that were available for possible takeover. I guess they have some long lease time on them preventing takeover.

@EdOverflow EdOverflow added the not vulnerable Someone has made it very clear that this service is not vulnerable to subdomain takeovers. label Feb 7, 2021
pahennig pushed a commit to pahennig/can-i-take-over-xyz that referenced this issue Jun 30, 2021
pahennig pushed a commit to pahennig/can-i-take-over-xyz that referenced this issue Jun 30, 2021
pahennig pushed a commit to pahennig/can-i-take-over-xyz that referenced this issue Jun 30, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
not vulnerable Someone has made it very clear that this service is not vulnerable to subdomain takeovers.
Projects
None yet
Development

No branches or pull requests

6 participants