Skip to content
HackIndex logo

HackIndex

Route53 and CloudFront Reconnaissance

2 min read May 24, 2026

Route53 and CloudFront leave distinct DNS fingerprints. Even without credentials, passive DNS and certificate transparency expose hosted zones, distribution endpoints, and dangling records.

CloudFront Distribution Fingerprinting

CloudFront distributions resolve to *.cloudfront.net. Identify which domains route through CloudFront:

┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN +short 
d1234abcd.cloudfront.net.
1.2.3.4

A CNAME to *.cloudfront.net confirms CloudFront is in the path. Bulk check across subdomains:

┌──(kali㉿kali)-[~]
└─$ subfinder -d $DOMAIN -silent | dnsx -silent -cname | grep cloudfront

Route53 DNS Fingerprints

Route53 nameservers follow a predictable pattern:

ns-123.awsdns-45.com
ns-678.awsdns-90.net
ns-1234.awsdns-56.org
ns-5678.awsdns-01.co.uk

Check if the target uses Route53:

┌──(kali㉿kali)-[~]
└─$ dig NS $DOMAIN +short | grep awsdns 
ns-123.awsdns-45.com.

Route53-hosted zones mean DNS changes are API-driven — relevant for later attacks via Route53 API if you gain credentials.

Subdomain Enumeration

┌──(kali㉿kali)-[~]
└─$ subfinder -d $DOMAIN -silent -all
┌──(kali㉿kali)-[~]
└─$ amass enum -passive -d $DOMAIN
┌──(kali㉿kali)-[~]
└─$ curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" | jq -r '.[].name_value' | sort -u | grep -v '*'

Filter for AWS-specific subdomains:

┌──(kali㉿kali)-[~]
└─$ subfinder -d $DOMAIN -silent | grep -E "s3|cloudfront|aws|lambda|execute-api|elb|elasticbeanstalk"

Subdomain Takeover via Dangling CNAMEs

Route53 and AWS services are common takeover targets. A CNAME pointing to an AWS endpoint that no longer exists is claimable.

High-value dangling targets:

Check for dangling CNAMEs:

┌──(kali㉿kali)-[~]
└─$ subfinder -d $DOMAIN -silent | while read sub; do
cname=$(dig CNAME $sub +short)
if [ -n "$cname" ]; then
resolved=$(dig $cname +short)
if [ -z "$resolved" ]; then
echo "[DANGLING] $sub -> $cname"
fi
fi
done 
[DANGLING] assets.example.com -> assets.example.com.s3.amazonaws.com.

Or use subjack:

┌──(kali㉿kali)-[~]
└─$ go install github.com/haccer/subjack@latest
┌──(kali㉿kali)-[~]
└─$ subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl
Explain command
-w subdomains.txt File with subdomains to check.
-t 100 Concurrent threads.

API Gateway Endpoints

API Gateway public endpoints follow:

https://$API_ID.execute-api.$REGION.amazonaws.com/$STAGE/

Discover via JavaScript files, GitHub search, or Burp passive scanning:

┌──(kali㉿kali)-[~]
└─$ gau $DOMAIN | grep "execute-api"

API Gateway endpoints returning {"message":"Missing Authentication Token"} on / confirm the endpoint exists. Enumerate paths from there.