I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain
I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain
They’d need a certificate authority to issue the certificate, and the victim’s browser would have to trust that authority.
Edit: and the scammer would need to control the domain DNS server to use the subdomain, like another reply said, so the certificate alone wouldn’t help much.
I’ve been able to downgrade https sites to plain http sites, through a series of loopholes which I won’t go into.
So you’ve… compromised your own security. Grats?
That’s nice, be sure to tell us how it goes when HSTS is enabled
Checks own servers…
Yeah, I’d like to see that…