HackBlue

Labs / DNS investigation

Dangling DNS record auditor

Audit ten records against live answers and the asset inventory. Find the CNAMEs, addresses, and delegations that point at things the company no longer owns.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

Ten records from the contoso.example zone, with what each name answers today and what the cloud asset inventory says about its target.

Audit the zone from the defender’s side: find the records that point at something the company no longer owns before someone else claims it. Lookups and HTTP checks are simulated.

Zone records

www.contoso.exampleCNAME
$ dig www.contoso.example CNAME
www.contoso.example.	300	IN	CNAME	contoso-web.frontdoor.example.
Resolves to
198.51.100.30
Service check
200 OK, Contoso home page
Inventory
Front Door profile contoso-web (active)

0 of 10 records marked.

Steps

  1. 01Mark every record in the zone as healthy, dangling, or leaking internal detail.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02Which dangling record gives whoever claims it the most control? Give the record name.

  3. 03old-api still answers with “Welcome to nginx”. Why is that a problem?

  4. 04When a team retires a cloud resource, what order prevents this?

  5. 05After you fix the records, which log helps you spot a certificate someone issued for a taken-over name?