DNS-DANGLING-CNAMEInitial Access

Dangling CNAME (host takeover)

Org CNAME points to an unclaimed cloud resource (S3 / Heroku / Azure App Service) — register it, serve attacker content under a trusted hostname.

§ Where this technique fits

DNS-DANGLING-CNAME is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

Subdomain takeover → ACME DNS-01 → trusted cert for victim host
Find a dangling CNAME / NS record. Claim the underlying resource; complete Let's Encrypt's DNS-01 challenge for the parent hostname. Now have a publicly-trusted cert for victim.example.com — chain into AITM.
step 1 / 6

§ What commonly comes next

01
Subdomain Takeover
W-SUBDOMAIN-TAKEOVER · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Subdomain takeover → ACME DNS-01 → trusted cert for victim host

§ What commonly comes next