exploiting-broken-link-hijacking

利用失效链接劫持

何时使用

• 在审计 Web 应用是否存在指向过期或未认领外部资源的引用时
• 在对第三方脚本和资源依赖进行供应链安全评估时
• 在测试通过悬空 CNAME 记录进行子域接管的机会时
• 在漏洞赏金狩猎中寻找失效链接劫持漏洞时
• 在评估生产应用中外部资源依赖的安全性时

前提条件

• 用于发现所有外部链接的 Web 爬虫或蜘蛛（Burp Suite Spider、Scrapy）
• 用于检查 CNAME 记录和域名可用性的 DNS 查询工具
• 用于认领过期域名的域名注册商访问权限（作为概念验证）
• 了解 CDN 和云服务配置（S3、Azure Blob、GitHub Pages）
• blc（broken-link-checker）或类似工具用于自动化链接验证
• 了解易受子域接管影响的服务（can-i-take-over-xyz）

法律声明： 本技能仅用于授权的安全测试和教育目的。未经授权对您不拥有或未获得书面许可测试的系统使用是非法的，可能违反计算机欺诈法律。

工作流

步骤 1 — 爬取并提取所有外部引用

# Use broken-link-checker to find dead links
npx broken-link-checker http://target.com --recursive --ordered \
  --exclude-internal --filter-level 3 -o broken_links.txt

# Extract all external links from page source
curl -s http://target.com | grep -oP 'https?://[^"'"'"'\s>]+' | sort -u > all_links.txt

# Extract JavaScript sources
curl -s http://target.com | grep -oP 'src="[^"]*"' | grep -v target.com > external_scripts.txt

# Extract CSS references
curl -s http://target.com | grep -oP 'href="[^"]*\.css"' | grep -v target.com > external_css.txt

# Use wayback machine for historical external references
curl -s "https://web.archive.org/web/timemap/link/http://target.com" | \
  grep -oP 'https?://[^>]+' | sort -u > historical_links.txt

# Spider with Burp Suite
# Configure Spider scope to include target.com
# Review Site Map > Filter by "External" to list all external references

步骤 2 — 识别失效或可认领的资源

# Check if external domains are registered
for domain in $(cat external_domains.txt); do
  whois $domain 2>/dev/null | grep -qi "no match\|not found\|available" && \
    echo "[CLAIMABLE] $domain"
done

# Check HTTP status of external links
while read url; do
  status=$(curl -o /dev/null -s -w "%{http_code}" "$url" --max-time 5)
  if [ "$status" = "000" ] || [ "$status" = "404" ]; then
    echo "[DEAD] $url (Status: $status)"
  fi
done < all_links.txt

# Check for dangling CNAME records
for sub in $(cat subdomains.txt); do
  cname=$(dig +short CNAME $sub)
  if [ -n "$cname" ]; then
    resolved=$(dig +short $cname)
    if [ -z "$resolved" ]; then
      echo "[DANGLING] $sub -> $cname (UNRESOLVED)"
    fi
  fi
done

# Check cloud resource availability
# AWS S3 bucket
aws s3 ls s3://target-assets 2>&1 | grep -q "NoSuchBucket" && echo "[CLAIMABLE] S3: target-assets"

步骤 3 — 检查特定服务的接管可能性

# Check GitHub Pages takeover
# If CNAME points to <user>.github.io and 404 is returned
curl -s https://subdomain.target.com | grep -q "There isn't a GitHub Pages site here"

# Check AWS S3 takeover
curl -s http://subdomain.target.com | grep -q "NoSuchBucket"

# Check Azure Blob Storage
curl -s http://subdomain.target.com | grep -q "The specified container does not exist"

# Check Heroku
curl -s http://subdomain.target.com | grep -q "No such app"

# Check Shopify
curl -s http://subdomain.target.com | grep -q "Sorry, this shop is currently unavailable"

# Use subjack for automated takeover detection
subjack -w subdomains.txt -c fingerprints.json -t 100 -o takeover_candidates.txt

# Use nuclei takeover templates
subfinder -d target.com -silent | nuclei -t http/takeovers/ -o takeovers.txt

步骤 4 — 验证外部脚本劫持

# Check if external JavaScript domains are available for registration
curl -s http://target.com | grep -oP 'src="https?://([^/"]+)' | \
  cut -d'/' -f3 | sort -u | while read domain; do
    whois "$domain" 2>/dev/null | grep -qi "no match\|available" && \
      echo "[HIJACKABLE SCRIPT] $domain loaded by target.com"
  done

# Check npm/CDN package references
curl -s http://target.com | grep -oP 'unpkg\.com/[^@/]+' | sort -u
curl -s http://target.com | grep -oP 'cdn\.jsdelivr\.net/npm/[^@/]+' | sort -u

# Verify if referenced packages still exist
# Check npm registry for deprecated or removed packages

步骤 5 — 利用失效链接（仅限授权测试）

# For expired domain: Register the domain
# For S3 bucket: Create bucket with same name in same region
aws s3 mb s3://target-expired-bucket --region us-east-1

# For GitHub Pages: Create repository with matching name
# Create <org>.github.io repository with proof-of-concept content

# For unclaimed social media: Claim the handle
# Document the takeover with benign proof-of-concept content

# Serve proof-of-concept content
echo "<html><body><h1>Broken Link Hijacking PoC - [Your Name]</h1></body></html>" > index.html
# Upload to claimed resource

步骤 6 — 评估影响并报告

# Determine impact based on resource type:
# - External JavaScript: Full XSS on all pages loading the script
# - External CSS: UI defacement, data exfiltration via CSS injection
# - External image/resource: Phishing, tracking
# - CNAME subdomain: Cookie theft, phishing, OAuth bypass

# Check if hijacked resource serves cookies for parent domain
# Check if hijacked subdomain is in OAuth redirect whitelist
# Verify if hijacked domain receives sensitive Referer headers

关键概念

概念	描述
失效链接劫持	获取目标网站引用的外部资源的控制权
悬空 CNAME	指向未认领或已停用服务的 DNS CNAME 记录
子域接管	通过配置其 CNAME 指向的服务来认领子域
外部脚本劫持	注册目标加载的 JavaScript 所来自的过期域名
供应链攻击	破坏外部依赖以注入恶意内容
失效链接	返回 404 或 DNS 解析失败的 URL 引用
资源指纹识别	从错误消息和响应头中识别特定的云服务

工具与系统

工具	用途
broken-link-checker	通过 Web 爬取自动发现失效链接
subjack	子域接管检测工具
nuclei	基于模板的接管检测扫描器
can-i-take-over-xyz	易受接管影响服务的社区数据库
BadDNS	用于检测域名/子域接管的 DNS 审计工具
Wayback Machine	用于发现过去外部引用的历史 URL 分析

常见场景

1. JavaScript 供应链 — 注册目标加载的 JavaScript 所来自的过期域名；注入影响所有访问者的恶意代码
2. S3 存储桶接管 — 认领目标引用的已删除 AWS S3 存储桶；提供恶意内容或窃取上传的数据
3. GitHub Pages 劫持 — 创建与悬空 CNAME 匹配的 GitHub Pages 仓库，在目标子域上提供钓鱼页面
4. 社交媒体冒充 — 认领目标网站链接的未认领社交媒体账号，进行品牌冒充
5. CDN 包劫持 — 认领通过 CDN URL 引用的已弃用 npm 包，注入恶意 JavaScript

输出格式

## Broken Link Hijacking Report
- **Target**: http://target.com
- **Total External Links**: 145
- **Dead Links**: 12
- **Hijackable Resources**: 3

### Findings
| # | Resource | Type | Status | Impact |
|---|----------|------|--------|--------|
| 1 | analytics.expired-domain.com | JavaScript | Domain available | Full XSS |
| 2 | assets.target.com -> S3 bucket | Static assets | Bucket deleted | Content injection |
| 3 | blog.target.com -> GitHub Pages | Subdomain | No GitHub repo | Subdomain takeover |

### Remediation
- Remove references to decommissioned external resources
- Delete dangling CNAME records for unused subdomains
- Implement Subresource Integrity (SRI) for external scripts
- Regularly audit external dependencies for availability
- Use Content Security Policy to restrict allowed script sources