cloud
3 articles with this tag
Subdomain takeover (dangling DNS) — your domain is served by an attacker, and your servers were never touched
Delete a cloud resource without deleting the DNS record and you have a dangling entry: anyone can claim that subdomain by provisioning a resource with the same FQDN. Your servers stay untouched while a legitimate subdomain serves an attacker's content. The damage is not cosmetic — apps commonly expose session cookies to wildcard subdomains, so the hijacked one can read them. And the documentation explicitly rejects the belief that a certificate protects you. The fix is making deletion order a mechanism, not a memory.
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every hop could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound fetches.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server hit internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and to close redirect/DNS-rebinding gaps. It was the entry point of the Capital One breach.