Microsoft Azure proofs

[PatrikHudak]

Service name

Microsoft Azure

Proof

There is no general approach for PoC. Microsoft Azure offers multiple services (CloudApp, Azure Websites, etc.) that use different domain names.

General approach in verifying subdomain takeover is to check, whether the Azure domain responds with NXDOMAIN DNS status. This is (to my knowledge) the necessary condition of the domain, however it is not sufficient. In other words, not all Azure domains which are used in some CNAME and respond with NXDOMAIN are vulnerable to subdomain takeover. I personally got a case where Azure portal refused to create a domain even though it responded with NXDOMAIN.

Some H1 reports to prove this point:

• https://0xpatrik.com/subdomain-takeover-starbucks/ (HackerOne: https://hackerone.com/reports/325336)
• https://0xpatrik.com/subdomain-takeover-starbucks-ii/ (HackerOne: https://hackerone.com/reports/388622)

As mentioned before, the PoC creation depends on the service in question, however, they generally tend to have similar workflows.

Documentation

These are the domains that are identified as vulnerable. Each of these is used for particular Azure service:

• *.cloudapp.net
• *.cloudapp.azure.com
• *.azurewebsites.net
• *.blob.core.windows.net
• *.cloudapp.azure.com
• *.azure-api.net
• *.azurehdinsight.net
• *.azureedge.net
• *.azurecontainer.io
• *.database.windows.net
• *.azuredatalakestore.net
• *.search.windows.net
• *.azurecr.io
• *.redis.cache.windows.net
• *.azurehdinsight.net
• *.servicebus.windows.net
• *.visualstudio.com

[Sechunt3r]

Hi All,
Hope you are good!

if a Azure Domain not Respond with NXDOMAIN that means it is not Vulnerable.
But if it shows this ;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR,

Then what would be the answer is it vulnerable or not!

Hope you understand my points

Regards
Shivam

[codingo]

Linked back on the main repository, closing this as @Sechunt3r's comment is already addressed in @PatrikHudak's summary.

[ghsec]

if subdomain return public IP is possible subdomain takeover?

[sumgr0]

If the sub-domain points to traffic manager service for Azure, is the takeover possible? When attempting to create a traffic manager profile using the same name as in the CNAME, getting error which mentions "Domain name xyz.trafficmanager.net already exists. Please choose a different DNS prefix".

Has Microsoft patched the service or am I doing something wrong?

Thanks

[PatrikHudak]

@sumgro Microsoft haven't patched the service and you are doing everything ok.

You are getting a error message because the Traffic Manager profile actually EXIST, so you are unable to claim it. When you make a DNS request to *.trafficmanager.net and get NXDOMAIN there are two possible outcomes:

1. The Traffic Manager with requested name really don't exist - you can go ahead and register it. In this context it is likely that the Subdomain Takeover is possible.
2. (From my own testing) Traffic Manager profile can be created, however there is no requirement to assign it any endpoints by default. Traffic Manager (as the name) implies is trying to distribute network traffic using different settings and acts just as a middleman. This means that in order it to work, you need to set up endpoints (a.k.a. FQDN) where the traffic will be forwarded once the user reaches to something.trafficmanager.net. Now to the core of the problem: When there is no endpoint assigned in the profile, you will get the same NXDOMAIN response as you would get with non-existing TM profile. In this case, you won't be able to take in over because the TM profile with the name in CNAME record actually exist, it just seems that the profile does not exist.

It is pretty easy to setup a automation for that using Azure API. You would need to test a creation of particular TM profile and not rely only on DNS request as some external indicator of TM profile existence.

Hope it helps.

[sumgr0]

Thank you for the revert @PatrikHudak, really appreciate the detailed reply.

I'm fairly new to the subdomain takeover subject. When testing for the subdomain in question, the dig <subdomain.domain.com> confirmed the error NXDOMAIN (thereby bringing a smile) and then the CNAME pointed to xyz.trafficmanager.net.

From your reply, I understand that the profile already exists with the same name as the CNAME, even when the end-point may not have been setup, this results in the error message both when visiting the link and through the dig command. Hence, the takeover for in this situation may not be successful.

Not able to get the pointers on the Azure API for automation, kindly point in the direction to be able to research more on the topic to get an understand for future hunting.

Thanks

[sumgr0]

I've come across a sub-domain, pointing to an azure web app service. This CNAME itself has 3 levels like xyz.abc.m.azurewebsites.net. It shows the NXDOMAIN error when checking with dig.

However, when I try to create the App on the Azure Portal as xyz.abc.m to takeover, it does not allow periods in the same. Anyone aware of how can such scenario be handled for sub-domain takeover?

Thanks

[nikokosm]

I also faced this. I found a subdomain that resolved to xyz.easteurope.cloudapp.azure.com and could not use the . character. Anyone else got around this?

Edit: turns out you could take over this by registering an Azure VM in the easteurope region ;)

[sumgr0]

found this in relation to the above, but haven't been able to go through in details to understand:
https://docs.microsoft.com/en-us/azure/app-service/environment/using-an-ase

[AdmiralGaust]

I found a subdomain pointing to 104.211.97.138. The ip certificate is issued to *.azurewebsites.net and the subdomain does not contain txt record.

Is it vulnerable to subdomain takeover?

[marcelo321]

I think it is a Edge case too.

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2616
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

"Domain name redacted.trafficmanager.net already exists. Please choose a different DNS prefix."

[marcelo321]

Can anyone confirm if this isn't possible or im just stupid?

when tryin to claim a CNAME with multiple levels like abc.aaa.azurewebsite.net i get

. is an invalid character

this means it is only possible to claim 1 level subdomains like abc.azurewebsite.net?

[hamzaavvan]

Which azure service gives us mysubdomain.windows.net ?
Any help would be appreciated.

[chiko360]

how can i claim this *.cloudapp.azure.com ?

[davisfreimanis]

how can i claim this *.cloudapp.azure.com ?

You can simply create a Virtual Machine in the specific region and then in the left menu select "Configure" and set a desired DNS name label.

The format of the URL will be:
<dnsname>.<region>.cloudapp.azure.com

[stark0de]

Does anyone know if it is possible to claim *.azurewebsites.us domains?

[adityathebe]

Is this still vulnerable ? Because Azure requires a unique Custom Domain Verification ID to be put as a TXT record in the DNS.

Until the TXT record is configured the following error will show up

I have only tried this for Web Apps (.azurewebsites.net)

[EdOverflow]

https://docs.microsoft.com/en-us/microsoft-365/admin/dns/create-dns-records-for-azure-dns-zones

@adityathebe, it appears that this is no longer vulnerable. :(

[EdOverflow]

Never mind, it’s still vulnerable. Just observed one get snatched live. 😂

[mcipekci]

They are but normal person can not takeover them, you must be govt. employee or contractor and have access to azure govt cloud. So its hard and edge case. 24 Şub 2023 Cum, saat 10:46 tarihinde Prabin Sigdel < ***@***.***> şunu yazdı:

Is this vulnerable ? site.target.com CNAME name.usgovtrafficmanager.net — Reply to this email directly, view it on GitHub <#35 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ALOHNRMXFRLVEOQ6IHV6HFTWZBRLZANCNFSM4FUUY4JQ> . You are receiving this because you commented.Message ID: ***@***.***>

-- iPhone'umdan gönderildi

[vitorfhc]

Azure Cloud Services (classic) is not vulnerable anymore because they don't let me upload a deployment using it. They are enforcing the new version, which, afaik is not vulnerable.

[Hacktus]

*.azurewebsites.net still vulnerable, took over another one by following : https://godiego.co/posts/STO-Azure/#azure-websites

[brad-ak]

Azure Cloud Services (classic) is not vulnerable anymore because they don't let me upload a deployment using it. They are enforcing the new version, which, afaik is not vulnerable.

I'm seeing the same. When using cloud services (extended support), it will deploy, but will not claim the cname in DNS. It allows for a custom domain, but that gives you a region.cloudapp.azure.com address, instead of a cloudapp.net address.

[Xib3rR4dAr]

*.azurewebsites.net takeover is still possible, tookover 2 domains. (Vulnerable domain must not have a TXT record containing asuid.{vulnerablesubdomainhere})

[marcelo321]

I am finding more and more un-exploitable cases, not sure what's going on.

[molitona]

can southeastasia.cloudapp.azure.com be taken over? i haven't found southeastasia in regions with my azure for students subs when creating a vm ?

@supr4s @akincibor @4c1d8urn-eh @brad-ak @vitorfhc

[digitaloceansnssn]

I am not getting any successful takeovers on *.{region}.cloudapp.azure.com and *.trafficmanager.net Looks like these takeovers are dying :(

[damaidec]

for *.cloudapp.net will this be possible for subdomain take over ? since Cloud Services (classic) is now deprecated and will retire on August 31, 2024. Currently im trying to make a PoC for cloudapp.net using Cloud Service classic but it seems like there's error on deployment which gave conflict error, status code 409

tried also creating creating Cloud service extended support but looks like its not possible for STO for now

Stanislav Zhelyazkov said
This means that you cannot longer deploy Cloud Services (classic) on new subscriptions/tenants. You can only manage existing deployments of those until August 31st, 2024.

references
https://learn.microsoft.com/en-us/answers/questions/1166622/unable-to-deploy-cloud-services-classic

https://learn.microsoft.com/en-us/answers/questions/1034947/classic-cloud-services-deployment-update-before-mi?orderby=newest

https://learn.microsoft.com/en-us/azure/cloud-services/cloud-services-update-azure-service

[pdelteil]

for *.cloudapp.net will this be possible for subdomain take over ? since Cloud Services (classic) is now deprecated and will retire on August 31, 2024. Currently im trying to make a PoC for cloudapp.net using Cloud Service classic but it seems like there's error on deployment which gave conflict error, status code 409

tried also creating creating Cloud service extended support but looks like its not possible for STO for now

Stanislav Zhelyazkov said This means that you cannot longer deploy Cloud Services (classic) on new subscriptions/tenants. You can only manage existing deployments of those until August 31st, 2024.

references https://learn.microsoft.com/en-us/answers/questions/1166622/unable-to-deploy-cloud-services-classic

https://learn.microsoft.com/en-us/answers/questions/1034947/classic-cloud-services-deployment-update-before-mi?orderby=newest

https://learn.microsoft.com/en-us/azure/cloud-services/cloud-services-update-azure-service

You are right. In order for this to work is to find an account that had the classic services before the change. So, chances you will find an account with those characteristics are very low.

[xafirk]

*.windows.net Is this vulnerable?

[Owatron]

Found a subdomain which I feel like its vulnerable to subdomain takeover , It doesnt have a cname record but has A record and TXT record TXT record points *.azurewebsites.net is it vulnerable ? New to subdomain takeover , appreciate the help!

[xcapri]

Hey I found a subdomain with cname *.region.cloudapp.azure.com
and when trying to take over I got an error: DNS name label not available. Try using a different label.

So this is not a vuln or a misstep ?

[marcelo321]

Seems like azure isn't vulnerable anymore, I was one of the hunters who submitted a few reports per week, now almost nothing at all. Azure made changes to prevent insta takeovers

[Wheelsinn001]

*.windows.net Is this vulnerable?

Were you able to takeover? I am stuck with an enterpriseregistration.windows.net

[randyranderson]

Hi,
I have various *.cloudapp.net subdomains registered but I cannot seem to deploy a proof.

Does anyone have any up to date instructions on creating PoC code for cloud services?

This method in this article is out of date and the code no longer works
https://godiego.co/posts/STO-Azure/

[4nibhal]

I'm pretty sure Microsoft has fixed this one at least on region.cloudapp.azure.com and azurewebsites.net.
I have tried to make 2 acquisitions, but now there are filters preventing the acquisition.

[EzequielPuig]

Definitions.

VULNERABLE -> this subdomain can be taken over the 100% of the times, with no limitations whatsoever, allowing a full Subdomain Takeover or some sort of Subdomain Takeover that contemplates the possibility of a valid vulnerability, affecting somehow the owner of the subdomain.

EDGE CASE -> this subdomain can be taken over, but there are some limitations. These limitations vary significantly depending on the resource/service provider and an indefinite number of external causes. The statistical probability of a Subdomain Takeover decreases significantly, however there is still a possibility through some sort of workaround/bypass/configuration/scenario/etc.

NO LONGER VULNERABLE -> this subdomain was vulnerable in the near/distant past, but it is not anymore, for whatever reason (remediations, etc). You will find tons of information on the internet, that will lead you to absolutely nowhere. So stop wasting your precious time and move on.

NOT VULNERABLE -> this subdomain cannot be taken over, under absolutely no circumstances, with no bypasses, no workarounds, no nothing whatsoever.

NO INFORMATION -> there is no information yet as to whether a Subdomain Takeover is possible or not.

Azure Service Endpoints.

CNAME Record of a Subdomain pointing to:

*.azurewebsites.net | EDGE CASE
*.azure-api.net | EDGE CASE
*.cloudapp.azure.com | EDGE CASE
*.cloudapp.net | NO LONGER VULNERABLE
*.trafficmanager.net | NO LONGER VULNERABLE

for all effects, if a Service Endpoint is not on this list, consider it NO INFORMATION, until further updates.

Relevant Information.

this list is updated frequently.

last update: 03/October/2023

if doubts/comments/suggestions, contact via LinkedIn https://www.linkedin.com/in/ezequielpuig/

[zy9ard3]

Changes :

*.azurewebsites.net | EDGE CASE => *.azurewebsites.net | NO LONGER VULNERABLE ( Enforced mandatory TXT verification )

[EzequielPuig]

@zy9ard3

It's true that on some occasions a mandatory TXT verification is needed to perform the Subdomain Takeover. However, there are still some situations in which this is not the case and the takeover can be done without this verification.

[zy9ard3]

@EzequielPuig

However, there are still some situations in which this is not the case and the takeover can be done without this verification

Kindly can you elaborate the scenario please which will be helpful to the community !!!

[mohamed-faris]

can someone please provide me step by step how to make the takeover
because I didn't know how to use azure

[Owatron]

is azurewebsites.net not vulnerable now ? filters are blocking takeover

[4nibhal]

In *azurewebsites.net, there is also a verification of DNS records.
Still try it always, and if you find something different you could share it with the community :D

[mohamed-faris]

what about this

[PH-Apolonio]

hey guys, is this still vulnerable to subdomain takeover?

[4nibhal]

@PH-Apolonio hey hey could you climb that?
have you been able to takeover?

[pdelteil]

Guys, traffic manager is not vulnerable since at least 2 years.

[devbertram]

Hi everyone. is *.azureedge.net still vulnerable? Tried some approach via CDN Profile and not working.

[xMrEhAcKeR]

Hello Guys, hope you're all good!.
I found *.southafricanorth.cloudapp.azure.com and the server status is showing NXDOMAIN, I wonder if this is sill available to takeover. i spent 2 days trying =_=l