论文标题
我可以带你的子域吗？探索现代网络中的相关域攻击
Can I Take Your Subdomain? Exploring Related-Domain Attacks in the Modern Web
论文作者
论文摘要
相关域攻击者控制其目标Web应用程序的同级域，例如，由于子域接管的结果。尽管对传统的网络攻击者有额外的力量，但相关域攻击者仅受到研究界的关注有限。在本文中，我们首次定义和量化有关域攻击者对Web应用程序安全性的威胁。特别是，我们首先阐明了相关域攻击者可以通过不同的攻击向量获得的功能，这表明相关域攻击者概念的不同实例值得关注。然后，我们研究如何滥用这些功能来损害Web应用程序的安全性，包括：Cookie，CSP，CORS，CORS，PostMessage和域放松。通过在此框架上构建，我们报告了Tranco列表中最高50K域的大规模安全测量，该列表导致在887个站点发现漏洞，在那里我们量化了相关域攻击者对流行Web应用程序构成的威胁。
Related-domain attackers control a sibling domain of their target web application, e.g., as the result of a subdomain takeover. Despite their additional power over traditional web attackers, related-domain attackers received only limited attention by the research community. In this paper we define and quantify for the first time the threats that related-domain attackers pose to web application security. In particular, we first clarify the capabilities that related-domain attackers can acquire through different attack vectors, showing that different instances of the related-domain attacker concept are worth attention. We then study how these capabilities can be abused to compromise web application security by focusing on different angles, including: cookies, CSP, CORS, postMessage and domain relaxation. By building on this framework, we report on a large-scale security measurement on the top 50k domains from the Tranco list that led to the discovery of vulnerabilities in 887 sites, where we quantified the threats posed by related-domain attackers to popular web applications.
