-
Notifications
You must be signed in to change notification settings - Fork 21
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vulcan subdomain takeover #790
base: master
Are you sure you want to change the base?
Conversation
2443094
to
edef026
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great job.
I added some minor comments, but the main concern is that it doesn't take into consideration multi region.
Apart from that I think the name of the check is too generic for the current implementation. One posibility could be to change to vulcan-aws-subdomain-takeover
. Other posibility could be to include this functionality in the current vulcan-aws-alerts
check.
Apart from that, I probably base the PR on master and not to checkshttp to prevent blockings.
d831051
to
864e8c0
Compare
c8da9e2
to
c22d1f2
Compare
6ff6e69
to
613d192
Compare
a1d34d3
to
2c4584a
Compare
It's necessary to implement a check to detect potential subdomain takeovers.
The flow that generates the vulnerability is: