Subdomain DNS da ko'rsatilgan, lekin hosting xizmati o'chirilgan — DNS hali eski IP yoki "CNAME" ni ko'rsatadi. Hujumchi o'sha xizmatda o'z hisobini ochadi va subdomain o'ziga o'tadi.

// 1) DNS da:
test.site.uz  CNAME  oqingiz-sayt.herokuapp.com     // app o'chirilgan

// 2) Heroku'da o'sha nom bilan app yaratamiz
// → DNS ko'rsatgan joy endi BO'SH → bizning kontentimiz

// 3) natija:
https://test.site.uz → "Bu sayt biznikida" + cookie o'g'rlash + XSS

# 1) subdomenlarni topish
subfinder -d site.uz -o subs.txt
assetfinder --subs-only site.uz
amass enum -d site.uz -o subs.txt

# 2) o'lik izlar (dangling) — barchasiga HTTP javobi
while read S; do
  IP=$(dig +short $S | tail -1)
  C=$(curl -s -m 5 -o /dev/null -w "%{http_code}" "https://$S" 2>/dev/null)
  [ "$C" = "000" ] && [ -n "$IP" ] && echo "  $S → $IP (o'lik)"
done < subs.txt

# 3) CNAME nishonlarini tekshirish
dig +short CNAME test.site.uz
dig +short CNAME dev.site.uz

# 4) xizmat fingerprint (firma belgisi)
curl -s "https://o'lik-sub.site.uz" | grep -iE "no such app|heroku|route not found|
  aws|s3|azure|gcp|firebase|netlify|vercel|ghost|blogspot|surge|readthedocs|
  wordpress|cloudfront|elasticbeanstalk"

# 5) kodda
grep -rniE "CNAME|heroku|azurewebsites|cloudfront|appspot|firebaseapp|vercel" . | head

# 1) to'liq pipeline
subfinder -d site.uz -silent -o subs.txt
for S in $(cat subs.txt); do
  R=$(curl -s -m 5 -D- "https://$S" 2>/dev/null)
  C=$(echo "$R" | grep -oE "^[a-zA-Z0-9/._ -]+$" | head -1)
  CODE=$(echo "$R" | head -1)
  CN=$(dig +short CNAME "$S" | tail -1)
  if echo "$C" | grep -qiE "heroku|azurewebsites|cloudfront|appspot|
      firebaseapp|netlify|vercel|s3|elasticbeanstalk|surge|ghost"; then
    echo "  ⚠ $S → $C ($CN)"
  fi
done

# 2) 4 ta domen qatori (barchasi tez)
for D in site.uz site.com site.net site.org; do
  for S in dev api staging test admin v1 beta old new; do
    CN=$(dig +short CNAME "$S.$D" | tail -1)
    [ -n "$CN" ] && echo "  $S.$D → $CN"
  done
done

# 3) nishon xizmatda o'z hisobingizni tekshirish (faqat o'z resurs)
#  misol uchun netlify: https://app.netlify.com/sites → "claim" imkoni
curl -s -o /dev/null -w "%{http_code}\n" https://api.netlify.com/api/v1/sites

# 4) Cookie atributlari (kengaytirilgan ta'sir)
curl -s -D- -o /dev/null https://site.uz/ | grep -i set-cookie
// Domain=.site.uz → barcha subdomenlar uchun umumiy

1. DNS auditi

dig +short CNAME _dmarc.site.uz
# har bir subdomen uchun xizmat va holatni ro'yxatga oling
# ishlatilmagan CNAME → DNS dan O'CHIRISH

2. Wildcard

# *.site.uz CNAME → xizmatga bog'lash XAVFLI
# o'rniga: wildcard yo'q, har bir subdomain aniq belgilanadi
dns: A  site.uz → IP
dns: A  www.site.uz → IP
# wildcard faqat sababnomali xavfsizlik (alohida zona)

3. Xizmat tomonda himoya

// Heroku/Netlify: o'chirilgan app o'rniga "claim" ni faqat egaga bering
// so'ng: DNS record O'CHIRILSIN

4. Cookie ni toraytirish

Set-Cookie: sid=...; Domain=; Path=/; Secure; HttpOnly; SameSite=Lax
// Domain belgisiz → faqat site.uz (sizning sayt)

5. Monitoring

• DNS o'zgarishlari uchun alert (DNSlytics, hetrix.tools)
• CNAME yangi xizmatga o'tsa — darhol tekshirish
• Wildcard topilsa — barcha subdomenlarni tekshirish

• Barcha subdomenlar ro'yxatga olingan
• O'lik CNAME larni o'chirilgan
• Wildcard (`*`) yo'q yoki nazorat qilinadi
• Cookie `Domain` belgisiz (tor)
• DNS o'zgarishlari monitoring qilinadi
• `subfinder` bilan CNAME lar tekshirildi