OWASP Domain Protect

Prevent subdomain takeover ...

... with serverless cloud infrastructure

OWASP Global AppSec Dublin - talk and demo

Features

scan Amazon Route53 across an AWS Organization for domain records vulnerable to takeover
scan Cloudflare for vulnerable DNS records
take over vulnerable subdomains yourself before attackers and bug bounty researchers
automatically create known issues in Bugcrowd or HackerOne
vulnerable domains in Google Cloud DNS can be detected by Domain Protect for GCP
manual scans of cloud accounts with no installation

Installation

the simplest way to install is to use the separate Domain Protect Deploy repository with GitHub Actions deployment workflow
for other methods see Installation

Collaboration

We welcome collaborators! Please see the OWASP Domain Protect website for more details.

Documentation

Manual scans - AWS
Manual scans - CloudFlare
Architecture
Database
Reports
Automated takeover optional feature
Cloudflare optional feature
Bugcrowd optional feature
HackerOne optional feature
Vulnerability types
Vulnerable A records (IP addresses) optional feature
Requirements
Installation
Slack Webhooks
AWS IAM policies
CI/CD
Development
Code Standards
Automated Tests
Manual Tests
Conference Talks and Blog Posts

Limitations

This tool cannot guarantee 100% protection against subdomain takeovers.