Skip to content

Commit 1653fc9

Browse files
RoseSecurityRoseSecurity
committed
feat: add azure subdomain enumeration
1 parent 09c2a19 commit 1653fc9

3 files changed

Lines changed: 243 additions & 0 deletions

File tree

‎Guides/Enum_AzureSubdomains/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# :cloud: Enum_AzureSubdomains: Anonymously Enumerating Azure Services
2+
3+
<p align="center">
4+
<img alt="AzureDoggo" src="https://user-images.githubusercontent.com/72598486/216847358-a72ce9e8-7d25-4b27-b386-f21d339580fa.png">
5+
</p>
6+
7+
Microsoft makes use of a number of different domains and subdomains for each of their Azure services. From SQL databases to SharePoint drives, each service maps to its respective domain/subdomain, and with the proper toolset, these can be identified through DNS enumeration to yield information about the target domain's infrastructure. ```enum_azuresubdomains.rb``` is a Metasploit module for enumerating public Azure services by validating legitimate subdomains through various DNS record queries. This cloud reconnaissance module rapidly identifies API services, storage accounts, key vaults, databases, and more! Expedite your cloud reconnaissance phases with ```enum_azuresubdomains.rb```.
8+
9+
## Domains and Associated Services:
10+
11+
| Domain | Associated Service |
12+
| --- | --- |
13+
| azurewebsites.net | App Services |
14+
| scm.azurewebsites.net | App Services - Management |
15+
| p.azurewebsites.net | App Services |
16+
| cloudapp.net | App Services |
17+
| file.core.windows.net | Storage Accounts-Files |
18+
| blob.core.windows.net | Storage Accounts-Blobs |
19+
| queue.core.windows.net | Storage Accounts-Queues |
20+
| table.core.windows.net | Storage Accounts-Tables |
21+
| redis.cache.windows.net | Databases-Redis |
22+
| documents.azure.com | Databases-Cosmos DB |
23+
| database.windows.net | Databases-MSSQL |
24+
| vault.azure.net | Key Vaults |
25+
| onmicrosoft.com | Microsoft Hosted Domain |
26+
| mail.protection.outlook.com | Email |
27+
| sharepoint.com | SharePoint |
28+
| azureedge.net | CDN |
29+
| search.windows.net | Search Appliance |
30+
| azure-api.net | API Services |
31+
32+
***NOTE: Enumerating existing Azure subdomains may be handy for anyone looking to conduct subdomain takeovers. Subdomain takeovers are typically done the other way around (finding a domain that’s no longer registered or in use), but by preemptively discovering the domains, and keeping tabs on them for later, you may be able to monitor for potential subdomain takeovers.***
33+
34+
# Demo:
35+
36+
https://user-images.githubusercontent.com/72598486/217250582-eada89ee-ac4a-41c3-8421-314aa8e75bca.mov
37+
38+
# Install:
39+
40+
Download repository:
41+
42+
```
43+
$ mkdir Enum_AzureSubdomains
44+
$ cd Enum_AzureSubdomains/
45+
$ sudo git clone https://github.com/RoseSecurity/Enum_AzureSubdomains.git
46+
```
47+
48+
Usage:
49+
50+
To load the script into Metasploit:
51+
52+
```
53+
# Create directory for module
54+
$ mkdir -p ~/.msf4/modules/auxiliary/gather
55+
# Move script into folder
56+
$ mv enum_azuresubdomains.rb ~/.msf4/modules/auxiliary/gather
57+
```
58+
59+
Fire up Metasploit:
60+
61+
```
62+
# Quietly start Metasploit and reload all modules
63+
$ msfconsole -q -x 'reload_all'
64+
# Use module
65+
msf6> use auxiliary/gather/enum_azuresubdomains
66+
```
67+
68+
If you encounter any errors, check the following log:
69+
70+
```
71+
$ tail ~/.msf4/logs/framework.log
72+
```
73+

‎Guides/Enum_AzureSubdomains/enum_azuresubdomains.rb‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::DNS::Enumeration
8+
9+
def initialize(info = {})
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Azure Subdomain Scanner and Enumerator',
14+
'Description' => 'This module enumerates public Azure services by locating valid subdomains through various DNS queries.',
15+
'Author' => ['RoseSecurity <RoseSecurityResearch[at]protonmail.me>'],
16+
'References' => ['www.netspi.com/blog/technical/cloud-penetration-testing/enumerating-azure-services'],
17+
'License' => MSF_LICENSE
18+
)
19+
)
20+
register_options(
21+
[
22+
OptString.new('DOMAIN', [true, 'The target domain without TLD (e.g., victim instead of victim.org)']),
23+
OptBool.new('PERMUTATIONS', [false, 'Prepend and append permuted keywords to the domain', false]),
24+
OptBool.new('ENUM_A', [true, 'Enumerate DNS A record', true]),
25+
OptBool.new('ENUM_CNAME', [true, 'Enumerate DNS CNAME record', true]),
26+
OptBool.new('ENUM_MX', [true, 'Enumerate DNS MX record', true]),
27+
OptBool.new('ENUM_NS', [true, 'Enumerate DNS NS record', true]),
28+
OptBool.new('ENUM_SOA', [true, 'Enumerate DNS SOA record', true]),
29+
OptBool.new('ENUM_TXT', [true, 'Enumerate DNS TXT record', true])
30+
]
31+
)
32+
end
33+
34+
def dns_enum(target_domains)
35+
target_domains.each do |domain|
36+
if dns_get_a(domain)
37+
print_good("Discovered Target Domain: #{domain}")
38+
perform_dns_queries(domain)
39+
end
40+
end
41+
end
42+
43+
def perform_dns_queries(domain)
44+
dns_get_a(domain) if datastore['ENUM_A']
45+
dns_get_cname(domain) if datastore['ENUM_CNAME']
46+
dns_get_ns(domain) if datastore['ENUM_NS']
47+
dns_get_mx(domain) if datastore['ENUM_MX']
48+
dns_get_soa(domain) if datastore['ENUM_SOA']
49+
dns_get_txt(domain) if datastore['ENUM_TXT']
50+
end
51+
52+
def generate_target_domains(domain, subdomains)
53+
if datastore['PERMUTATIONS']
54+
permuted_domains = generate_permutations(domain)
55+
(subdomains + permuted_domains).flat_map do |subdomain|
56+
subdomains.map { |tld| domain + tld }
57+
end
58+
else
59+
subdomains.map { |tld| domain + tld }
60+
end
61+
end
62+
63+
def generate_permutations(domain)
64+
keywords = %w[
65+
root web api azure azure-logs data database data-private data-public dev development
66+
demo files filestorage internal keys logs private prod production public service services
67+
splunk sql staging storage storageaccount test useast useast2 centralus northcentralus westcentralus
68+
westus westus2
69+
]
70+
keywords.flat_map do |keyword|
71+
["#{domain}-#{keyword}", "#{keyword}-#{domain}"]
72+
end
73+
end
74+
75+
def run
76+
domain = datastore['DOMAIN']
77+
subdomains = %w[
78+
.onmicrosoft.com .scm.azurewebsites.net .azurewebsites.net .p.azurewebsites.net .cloudapp.net
79+
.file.core.windows.net .blob.core.windows.net .queue.core.windows.net .table.core.windows.net
80+
.mail.protection.outlook.com .sharepoint.com .redis.cache.windows.net .documents.azure.com
81+
.database.windows.net .vault.azure.net .azureedge.net .search.windows.net .azure-api.net .azurecr.io
82+
]
83+
84+
target_domains = generate_target_domains(domain, subdomains)
85+
dns_enum(target_domains)
86+
end
87+
end

‎Guides/Enum_AzureSubdomains/msf.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
## Introduction
2+
Microsoft makes use of a number of different domains and subdomains for each of their Azure services. From SQL databases to SharePoint drives, each service maps to its respective domain/subdomain, and these can be identified through DNS enumeration to yield information about the target domain's infrastructure. ```enum_azuresubdomains.rb``` is a Metasploit module for enumerating public Azure services by validating legitimate subdomains through various DNS record queries. This cloud reconnaissance module identifies API services, storage accounts, key vaults, and databases.
3+
4+
## Verification Steps
5+
6+
1. Start `msfconsole`
7+
2. Do: `use auxiliary/gather/enum_azuresubdomains`
8+
3. Do: `set DOMAIN <Target Domain>`
9+
5. Do: `run`
10+
11+
## Options
12+
13+
**DOMAIN**
14+
15+
The target domain to enumerate without the Top Level Domain (Example: victim.org would just be victim).
16+
17+
**PERMUTATIONS**
18+
19+
This appends and prepends permutated keywords to identify common domain name variations.
20+
21+
22+
## Scenarios
23+
24+
Running the module against a real system (in this case, the University of Maryland's online Azure services):
25+
26+
```
27+
msf6 > use auxiliary/gather/enum_azuresubdomains
28+
msf6 auxiliary(gather/enum_azuresubdomains) > show options
29+
30+
Module options (auxiliary/gather/enum_azuresubdomains):
31+
32+
Name Current Setting Required Description
33+
---- --------------- -------- -----------
34+
DOMAIN yes The target domain without TLD (Ex: victim rather than victim.org)
35+
ENUM_A true yes Enumerate DNS A record
36+
ENUM_CNAME true yes Enumerate DNS CNAME record
37+
ENUM_MX true yes Enumerate DNS MX record
38+
ENUM_NS true yes Enumerate DNS NS record
39+
ENUM_SOA true yes Enumerate DNS SOA record
40+
ENUM_TXT true yes Enumerate DNS TXT record
41+
NS no Specify the nameservers to use for queries, space separated
42+
PERMUTATIONS false no Prepend and append permutated keywords to domain (This option can take minutes to complete)
43+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
44+
RPORT 53 yes The target port (TCP)
45+
SEARCHLIST no DNS domain search list, comma separated
46+
THREADS 1 yes Number of threads to use in threaded queries
47+
48+
49+
View the full module info with the info, or info -d command.
50+
51+
msf6 auxiliary(gather/enum_azuresubdomains) > set DOMAIN umuc365
52+
DOMAIN => umuc365
53+
msf6 auxiliary(gather/enum_azuresubdomains) > set PERMUTATIONS true
54+
PERMUTATIONS => true
55+
msf6 auxiliary(gather/enum_azuresubdomains) > run
56+
57+
[*] Discovered Target Domain: umuc365.mail.protection.outlook.com
58+
59+
[*] Querying DNS CNAME records for umuc365.mail.protection.outlook.com
60+
[*] Querying DNS NS records for umuc365.mail.protection.outlook.com
61+
[*] Querying DNS MX records for umuc365.mail.protection.outlook.com
62+
[*] Querying DNS SOA records for umuc365.mail.protection.outlook.com
63+
[*] Querying DNS TXT records for umuc365.mail.protection.outlook.com
64+
65+
[*] Discovered Target Domain: umuc365.sharepoint.com
66+
67+
[*] Querying DNS CNAME records for umuc365.sharepoint.com
68+
[+] umuc365.sharepoint.com CNAME: 2732-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com
69+
[*] Querying DNS NS records for umuc365.sharepoint.com
70+
[*] Querying DNS MX records for umuc365.sharepoint.com
71+
[*] Querying DNS SOA records for umuc365.sharepoint.com
72+
[*] Querying DNS TXT records for umuc365.sharepoint.com
73+
74+
[*] Discovered Target Domain: umuc365-web.sharepoint.com
75+
76+
[*] Querying DNS CNAME records for umuc365-web.sharepoint.com
77+
[+] umuc365-web.sharepoint.com CNAME: umuc365.sharepoint.com
78+
[*] Querying DNS NS records for umuc365-web.sharepoint.com
79+
[*] Querying DNS MX records for umuc365-web.sharepoint.com
80+
[*] Querying DNS SOA records for umuc365-web.sharepoint.com
81+
[*] Querying DNS TXT records for umuc365-web.sharepoint.com
82+
[*] Auxiliary module execution completed
83+
```

0 commit comments

Comments
 (0)