-
-
Notifications
You must be signed in to change notification settings - Fork 704
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can aws elasticbeanstalk service be takeover with env? #194
Comments
This 10-digit name is there for the exact reason you want to claim it. I remember reading a report once about someone who created tens of thousands of AWS services to try and get this same random code, but failed. |
I have performed takeovers in the past with this exact scenario. Unless AWS has updated that system you can attempt to claim an ElasticBeanstalk instance under the name of |
At this moment, Elastic beanstalk does not allow you to add special characters like
That is, at this moment, it's only possible to perform a takeover on this service if it was created with a custom name filled by the user, witch is quite normal. |
Taking over 6zycefn8gp.us-east-1.elasticbeanstalk.com, will give you access to any.6zycefn8gp.us-east-1.elasticbeanstalk.com (assuming the first is available here because you can configure the subdomain in your Apache/PHP configuration. You don't perform the takeover by adding the full name with the period. |
yes it makes sense but how to set "any.6zycefn8gp.us-east-1.elasticbeanstalk.com" after getting "6zycefn8gp.us-east-1.elasticbeanstalk.com"... aws then "." will it allow us to get a new elastic name using? Or do we need a wildcard cname-style setting without a new name? |
I don't speak English very well and if I'm not reading wrong, the answer to the question we're looking for is hidden here. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html |
The CNAME record AWS adds to their system is wildcarded if I remember correctly. So you just need to setup the configuration within the ElasticBeanstalk instance I believe. I'm away from my desktop so I can't go check the steps at the moment. |
did you find a way to takeover ? I have same problem here. |
yes this is still vulnerable |
is this vulnearble ? |
hello. I know it is possible for the aws elasticbeanstalk service to have a takeover if the conditions are met. For this, the region named elasticbeanstalk should be used. but if there is "env" in the same name, I don't know if it will be takeover.
example:
example.elasticbeanstalk.com > it is not vulnerable
example.us-west-2.elasticbeanstalk.com > it is vulnerable
example-env.6zycefn8gp.us-west-2.elasticbeanstalk.com > I don't know if this is vulnerable or not.
There is a 10-digit name in the subdomain after env. "6zycefn8gp" .. I think the aws service adds this automatically and I want to know if there is a method to get it.
The text was updated successfully, but these errors were encountered: