CRITICAL SEVERITYCLOUDCVSS 9.1Immediate (<90s)ID: aws-s3

AWS S3 Dangling DNS & Takeover Fingerprint

Q: What causes an AWS S3 subdomain takeover?

When an engineer configures a CNAME record (e.g. assets.example.com -> assets-corp.s3.amazonaws.com) and later deletes the S3 bucket without removing the DNS record, AWS frees the bucket namespace globally. Any AWS user can instantly provision a bucket named assets-corp and serve hostile content under your corporate domain.

An orphan CNAME points to an Amazon S3 bucket that was deleted or never created. An attacker can create the S3 bucket with the exact matching name in any AWS account and host arbitrary payloads or phishing pages on your domain.

DNS CNAME Delegation Rules

Target CNAME Delegation

*.s3.amazonaws.com / *.s3-website-*.amazonaws.com

DNS Resolution Indicator

CNAME resolves to an unallocated Amazon S3 bucket name. Host answers with HTTP 404.

Expected HTTP Status Code

404 Not Found

Authoritative Response Token

Vulnerable Body Indicator String

“NoSuchBucket”

CLI Verification Command

curl -sI -H 'Host: vulnerable.example.com' http://vulnerable.example.com.s3.amazonaws.com | grep 'NoSuchBucket'

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Immediate Action Required: Delete the dangling CNAME DNS record in your DNS provider immediately, or re-create the target S3 bucket under your own AWS account with appropriate public-access block controls.

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to *.s3.amazonaws.com / *.s3-website-*.amazonaws.com.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

resource "aws_route53_record" "dangling" {
  zone_id = var.hosted_zone_id
  name    = "subdomain.example.com"
  type    = "CNAME"
  # REMOVE OR POINT TO AN ACTIVE S3 BUCKET
}

Open Dedicated AWS S3 Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss AWS S3 Takeovers

Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

AWS S3 Takeover FAQs

When an engineer configures a CNAME record (e.g. assets.example.com -> assets-corp.s3.amazonaws.com) and later deletes the S3 bucket without removing the DNS record, AWS frees the bucket namespace globally. Any AWS user can instantly provision a bucket named assets-corp and serve hostile content under your corporate domain.

SubdomainWatch inspects the authoritative CNAME chain up to 8 hops and performs a bounded, passive HTTP probe. If the response contains the authoritative XML token <Code>NoSuchBucket</Code> and does not return AccessDenied, the endpoint is confirmed vulnerable.

Origin Access Control secures communication between CloudFront and S3, but if the public DNS CNAME points directly to an S3 website endpoint rather than CloudFront, OAC offers no protection. Always purge stale DNS records immediately.

FREE UNRESTRICTED SCANNER

Scan Your Domain for AWS S3 Orphans

Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.

LAUNCH TAKEOVER TOOL →Start Free 24/7 Monitor

CRITICAL SEVERITYCLOUDCVSS 9.1Immediate (<90s)ID: aws-s3

AWS S3 Dangling DNS & Takeover Fingerprint

DNS CNAME Delegation Rules

Target CNAME Delegation

*.s3.amazonaws.com / *.s3-website-*.amazonaws.com

DNS Resolution Indicator

CNAME resolves to an unallocated Amazon S3 bucket name. Host answers with HTTP 404.

Expected HTTP Status Code

404 Not Found

Authoritative Response Token

Vulnerable Body Indicator String

“NoSuchBucket”

CLI Verification Command

curl -sI -H 'Host: vulnerable.example.com' http://vulnerable.example.com.s3.amazonaws.com | grep 'NoSuchBucket'

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to *.s3.amazonaws.com / *.s3-website-*.amazonaws.com.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

resource "aws_route53_record" "dangling" {
  zone_id = var.hosted_zone_id
  name    = "subdomain.example.com"
  type    = "CNAME"
  # REMOVE OR POINT TO AN ACTIVE S3 BUCKET
}

Open Dedicated AWS S3 Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss AWS S3 Takeovers

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

AWS S3 Takeover FAQs

FREE UNRESTRICTED SCANNER

Scan Your Domain for AWS S3 Orphans

Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.

LAUNCH TAKEOVER TOOL →Start Free 24/7 Monitor