CloudFrunt - A Tool For Identifying Misconfigured CloudFront Domains

CloudFrunt is a tool for identifying misconfigured CloudFront domains.

Background

CloudFront is a Content Delivery Network (CDN) provided by Amazon Web Services (AWS). CloudFront users create "distributions" that serve content from specific sources (an S3 bucket, for example).

Each CloudFront distribution has a unique endpoint for users to point their DNS records to (ex. d111111abcdef8.cloudfront.net). All of the domains using a specific distribution need to be listed in the "Alternate Domain Names (CNAMEs)" field in the options for that distribution.

When a CloudFront endpoint receives a request, it does NOT automatically serve content from the corresponding distribution. Instead, CloudFront uses the HOST header of the request to determine which distribution to use. This means two things:

1. If the HOST header does not match an entry in the "Alternate Domain Names (CNAMEs)" field of the intended distribution, the request will fail.
   
2. Any other distribution that contains the specific domain in the HOST header will receive the request and respond to it normally.
   

This is what allows the domains to be hijacked. There are many cases where a CloudFront user fails to list all the necessary domains that might be received in the HOST header. For example:

• The domain "test.disloops.com" is a CNAME record that points to "disloops.com".
• The "disloops.com" domain is set up to use a CloudFront distribution.
• Because "test.disloops.com" was not added to the "Alternate Domain Names (CNAMEs)" field for the distribution, requests to "test.disloops.com" will fail.
• Another user can create a CloudFront distribution and add "test.disloops.com" to the "Alternate Domain Names (CNAMEs)" field to hijack the domain.

This means that the unique endpoint that CloudFront binds to a single distribution is effectively meaningless. A request to one specific CloudFront subdomain is not limited to the distribution it is associated with.

Installation

$ pip install boto3
$ pip install netaddr
$ pip install dnspython
$ git clone https://github.com/disloops/cloudfrunt.git
$ cd cloudfrunt
$ git clone https://github.com/darkoperator/dnsrecon.git

CloudFrunt expects the dnsrecon script to be cloned into a subdirectory called dnsrecon.

Usage

cloudfrunt.py [-h] [-l TARGET_FILE] [-d DOMAINS] [-o ORIGIN] [-i ORIGIN_ID] [-s] [-N]

-h, --help                      Show this message and exit
-s, --save                      Save the results to results.txt
-N, --no-dns                    Do not use dnsrecon to expand scope
-l, --target-file TARGET_FILE   File containing a list of domains (one per line)
-d, --domains DOMAINS           Comma-separated list of domains to scan
-o, --origin ORIGIN             Add vulnerable domains to new distributions with this origin
-i, --origin-id ORIGIN_ID       The origin ID to use with new distributions

Example

$ python cloudfrunt.py -o cloudfrunt.com.s3-website-us-east-1.amazonaws.com -i S3-cloudfrunt -l list.txt

 CloudFrunt v1.0.3

 [+] Enumerating DNS entries for google.com
 [-] No issues found for google.com

 [+] Enumerating DNS entries for disloops.com
 [+] Found CloudFront domain --> cdn.disloops.com
 [+] Found CloudFront domain --> test.disloops.com
 [-] Potentially misconfigured CloudFront domains:
 [#] --> test.disloops.com
 [+] Created new CloudFront distribution EXBC12DE3F45G
 [+] Added test.disloops.com to CloudFront distribution EXBC12DE3F45G

Download CloudFrunt

Related links

1. Physical Pentest Tools
2. Pentest Tools List
3. Best Hacking Tools 2019
4. Hacker
5. Hak5 Tools
6. Pentest Tools Github
7. Hack Tools Pc
8. Hacker Tools Hardware
9. Pentest Tools Kali Linux
10. Usb Pentest Tools
11. Install Pentest Tools Ubuntu
12. Hacking Tools Software
13. Hacker Tools Free Download
14. Pentest Tools Windows
15. Hacking Tools Hardware
16. Hacker Tools Online
17. Hacker Tools Hardware
18. New Hack Tools
19. Pentest Tools Apk
20. Hack Tools 2019
21. Hack Tools Github
22. Pentest Tools Kali Linux
23. Hack Apps
24. Kik Hack Tools
25. Growth Hacker Tools
26. Hacker Tools Apk
27. Hacker Search Tools
28. New Hack Tools
29. Hacking Tools For Windows
30. Hacking Tools Online
31. Pentest Tools Open Source
32. Install Pentest Tools Ubuntu
33. Hacker Tools List
34. Hacking Tools Windows
35. How To Make Hacking Tools
36. Hacking Tools 2020
37. Nsa Hack Tools
38. Pentest Tools List
39. Hacker Tools Linux
40. Hacker Tools List
41. What Are Hacking Tools
42. Hacker Tools For Ios
43. Hak5 Tools
44. Hacker Tools 2020
45. Pentest Tools List
46. Hacking Tools Free Download
47. Hack Tools
48. Usb Pentest Tools
49. Computer Hacker
50. Hacker
51. Blackhat Hacker Tools
52. Hacking Tools Mac
53. How To Install Pentest Tools In Ubuntu
54. Pentest Tools Apk
55. Hacking App
56. Hackers Toolbox
57. Hacking Tools Github
58. Hacker Tools Github
59. Hack Tools For Windows
60. Hacker Tools
61. Pentest Tools For Windows
62. Tools 4 Hack
63. Pentest Tools
64. Hacking Tools Free Download
65. Pentest Tools Alternative
66. Wifi Hacker Tools For Windows
67. Hacker Tools Mac
68. Hacking Tools Name
69. Top Pentest Tools
70. Hacker Tools For Pc
71. Pentest Tools Subdomain
72. Hack Tools
73. Hacker Tools
74. Hacking Tools Pc
75. Hak5 Tools
76. Beginner Hacker Tools
77. Hacker Tools Github
78. Hack Tools
79. Tools Used For Hacking
80. Hacking Tools And Software
81. Hacker Tools Software
82. Hacking Tools For Windows 7
83. Hack And Tools
84. Hacking App
85. Hacker Search Tools
86. Hack And Tools
87. Hacker Hardware Tools
88. Easy Hack Tools
89. Pentest Tools For Android
90. Kik Hack Tools
91. Ethical Hacker Tools
92. Underground Hacker Sites
93. Hacker Tools For Mac
94. Nsa Hack Tools Download
95. Hacks And Tools
96. Bluetooth Hacking Tools Kali
97. Blackhat Hacker Tools
98. Hacking Tools And Software
99. Pentest Tools For Ubuntu
100. Hacker Tools For Pc
101. New Hacker Tools
102. Hacker Tools 2020
103. Hacking Tools For Games