Hello, everyone, welcome to this video.
In this video, we are going to see one more AWS subdomain take-over just to make sure that we have
understood how to do this.
We are going to see one more target and we are going to repeat the steps very quickly of how to do this.
So the process remains exactly the same.
But for those who want to see once again how to do the steps, they can see this other can skip because
the process is somewhat the same.
All right.
So now once you have logged in over here, this is how the AWS management console looks like over here.
You have to search for S3.
I have already visited S3.
So it is going to show me recently visited services for you.
If you are logged in for the first time, you just need to search S3 over here and you will be get you
will be able to get it, as can see, storage S3 as shown over here.
So you can alternatively click over here as well.
All right.
So I have identified a subdomain which you can see over here, which is Add-Ons dot keppt dot com, and
you can see the error message, which we call our fingerprint, which is no such bucket.
The specified bucket does not exist.
Now, you can notice over here the message is exactly the same, but it is looking different because
in the previous video, the message was in XML version format and here it is not ,this is only the difference.
That is why I said you need to focus on to the fingerprint.
So the fingerprint is exactly the same, which is no such bucket.
The specified bucket does not exist.
And through this we can confirm that this particular subdomain is of one subdomain and it is pointing
to A.W.S..
All right.
So I'm going to create a bucket.
Remember, whenever you're going to create bucket A.W.S is bucket creation process does not like special
characters like HTTP colon slash slash
So you have to remove that and you have to give your bucket name now.
Choosing the region is very, very important.
So, again, how to choose a region, you just need to open up your terminal.
You need to type the command dig Cname because we want to see the name of that particular subdomain.
And you can see from here we have identified the Cname of this subdomain is S3 website hyphen us hyphen
East hyphen one dot Amazon A.W.S dot com.
So the region is basically US east one.
All right.
So once we have identified the correct region, we have to choose the bucket.
So let me go to US east.
As you can see, there is U.S. east North Virginia and U.S. East Ohio.
So from both of them, we can choose one of the region, but we do not know which is the right region.
So.
We will take help of a A.W.S. documentation, so let's go to A.W. documentation, so I'm going to go to
A.W.S Documentation and from here I am going to see that which region points to which code.
As we have seen, the code for us was U.S east 1.
Now, over here, let's search for US east one, and you can see that US East one code is for north
of Virginia.
All right.
So we have identified the correct region name according to the code.
So let me choose that and hit next.
Once I will hit next, I will go to the next option I have done versioning ON, it is optional.
If you do not want to turn it ON, then you can leave it blank.
That is only for taking all the versioning logs of whatever activities that is happening into your bucket.
Now you have to uncheck this block all public access, which makes our bucket publicily accessible and
available for everyone to view.
Now, once you have done that, you need to go to add ons dot keppt dot com.
That is your bucket name.
Then you have to upload a file.
So I'm going to upload a file quickly over here and hit.
Upload, so once you do this, the file will get uploaded, as you can see, it is in progress right
now.
Once that is done, you will be able to see your message, which is success.
Let's wait for this to get uploaded and you can see it is successfully uploaded.
Now, I need to make this file public, so I will click on it and click on Make Public.
Now I will go in.
Overview and go back to the bucket, the main thing to do over here is to perform static website hosting.
So let me just click on static website hosting and let me do the next steps again.
Remember, this server access logging option is purely optional and I will not recommend to do this
because it is going to create a lot of logs into your bucket.
I just wanted to see what are the logs that are being created into my bucket so I choose that particular
option that is optional, you can skip it as well.
Now, after going to the static website hosting, I'm going to choose the redirect request and I'm going
to give the sub domain name, as you can see over here.
Now, after I have given the sub domain name, you need to choose the protocol that is HTTP and hit,
OK?
Now, these are only the steps that you need to do.
Now, also, we have given the public access to this, let me create or let me click on this particular
link and you can see we are able to see the bucket. Now
You can see over here we are able to see error, which is too many redirect, maybe because it is redirecting
internally to our bucket.
So if you see a case like this, then you just have to wait for some time and again, try to open that
particular subdomain, which would fix the issue for you.
So I tried this after some time and I was able to successfully see that the subdomain was pointing correctly
and I was able to see the content that I hosted over there.
So I hope you guys understood how to do subdomain takeover's for A.W.S..
Thank you.