שיעורי מודול (2/3)
Record abbandonati e subdomain takeover
Dangling records and subdomain takeover
A dangling record points to an external service that has been removed or is no longer controlled. If a provider lets another user claim that service name, the old hostname may come under someone else’s control. This is one form of subdomain-takeover risk.
Inventory CNAMEs to SaaS, storage, and cloud platforms and compare them with active services. A “resource not found” error does not always prove that a name is vulnerable; confirmation depends on the provider. Do not try to claim resources belonging to someone else. Coordinate with the service owner to remove the record, restore the resource under authorized control, or transfer the dependency.
For example, if help.example.test CNAME tenant-old.vendor.test points to a deleted tenant, verify the asset and provider relationship. A safe decommissioning process removes the DNS alias or transfers the service before closing the cloud account. Track owners and expiry dates for external dependencies.
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What is the first defensive step for a CNAME pointing to a retired service?