I generated 16 character (upper/lower) subdomain and set up a virtual host for it in Apache, and within an hour was seeing vulnerability scans.

How are folks digging this up? What’s the strategy to avoid this?

I am serving it all with a single wildcard SSL cert, if that’s relevant.

Thanks

Edit:

  • I am using a single wildcard cert, with no subdomains attached/embedded/however those work
  • I don’t have any subdomains registered with DNS.
  • I attempted dig axfr example.com @ns1.example.com returned zone transfer DENIED

Edit 2: I’m left wondering, is there an apache endpoint that returns all configured virtual hosts?

Edit 3: I’m going to go through this hardening guide and try against with a new random subdomain https://www.tecmint.com/apache-security-tips/

  • SwissOS@sh.itjust.worksEnglish
    1·
    22 hours ago

    Do you use an external DNS when accessing your subdomain? I can only guess that it’s the DNS leaking it.

  • Fedditor385@lemmy.worldEnglish
    1·
    2 days ago

    If you have browser with search suggestions enabled, everything you type in URL bar gets sent to a search engine like Google to give you URL suggestions. I would not be surprised if Google uses this data to check what it knows about the domain you entered, and if it sees that it doesn’t know anything, it sends the bot to scan it to get more information.

    But in general, you can’t access a domain without using a browser which might send that what you type to some company’s backend and voila, you leaked your data.

  • oranki@sopuli.xyzEnglish
    1·
    2 days ago

    Maybe that particular subdomain is getting treated as the default virtual host by Apache? Are the other subdomains receiving scans too?

    I don’t use Apache much, but NGINX sometimes surprises on what it uses if the default is not specifically defined.

  • androidul@lemmy.worldEnglish
    0·
    3 days ago

    if you use Let’s Encrypt (ACME protocol) AFAIK you can find all domains registered in a directory that even has a search, no matter if it’s wildcard or not.

    It was something like this https://crt.sh/ but can’t find the site exactly anymore

    LE: you can also find some here https://search.censys.io/

    • Shimitar@downonthestreet.euEnglish
      0·
      2 days ago

      This.

      That’s why temping obscurity for security is not a good idea. Doesn’t take much to be “safe”, at least reasonably safe. But that not much its good practice to be done :)

      • Fair Fairy@thelemmy.clubEnglish
        0·
        2 days ago

        No. Not this.

        Op is doing hidden subdomain pattern. Wildcard dns and wildcard ssl.

        This way subdomain acts as a password and application essentially inaccessible for bot crawls.

        Works very well