51–60 of 77 posts
This looks like it was a fun project! For anyone who wants to research the subject, the class of security vulnerabilities are called DNS tunneling.
Yes. I recently wrote a Lua-scriptable DNS server called redns[1] (which seems to be a pretty popular name for hobbyist DNS servers, BTW) only to test some of those attacks. [1] https://github.com/luismedel/redns
Whenever I see regexs hanging off the Internet, my heart skips a beat! :)
Earlier quoted context omitted.
the site is down? - https://code.kyro.se/iodine/
Sorry I was on my smartphone and mistyped the url (it's kryo not kyro): https://code.kryo.se/iodine/ Thanks for pointing it out. EDIT: As an aside, I still hate how mobile browsers have the bad habits of reloading tabs (and most of the time loosing content) that you get back to with no reason. If not for this crappy behavior, I would have copy-pasted the URL.
- A website can bring its own DoH client and bypass both the OS resolver and the browser's trusted DoH resolver for anything except the initial page request.
- Any website can now access the full DNS information of any domain: Not just A/AAAA records, but also TXT, MX, SRV etc. Record metadata such as TTLs likewise.
All of that without requiring any backend infrastructure or exotic web API. It's literally just a static HTML file and fetch().
That's a genuinely new capability that wasn't available to websites before public DoH servers became available. I'm no security expert, but this smells like it should have some implications for web security.
dns works fine at those rates or higher, and you'll use caching dns servers of ISPs, scales like no other, geo support etc etc. I think its great idea for public data.
Earlier quoted context omitted.
It's true that people with JavaScript disabled won't be able to run any JavaScript, but once they turn it on it should have relatively good feature support -- I suspect the sort of people who know how to disable JavaScript aren't using software more than 5 years out of date.
> but once they turn it on it should have relatively good feature support How could they even know to tuen it on when all they get is an empty page?
The HTML bit is fun, but the more remarkable takeaway for me is that DoH servers accept cross-origin requests from ordinary javascript. This means two things: - A website can bring its own DoH client and bypass both the OS resolver and the browser's trusted DoH resolver for anything except the initial page request. - Any website can now access the full DNS information of any domain: Not just A/AAAA records, but also…
Not sure about that, since it doesn’t sound like simply requesting answers from the DOH server injects the answer into the DNS cache.
And I don’t think this is novel, since anyone could have ran a dns info api before if they really wanted to.
Well the content is stored in a DNS Zone file but it is requested using JavaScript to an external HTTP API. I wouldn't really call that HTML over DNS but rather "DNS Zone as blog database". Anyway, this made me think of iodine [1], an IP over DNS solution, which I still run on my main server even though it has a lot less use now than it had until a few years ago when there were a lot of open wifi with captive portals…
Or just call it HTML over CloudFlare? That CloudFlare uses DNS on the backend doesn't validate DNS being in the title IMHO
Earlier quoted context omitted.
It's true that people with JavaScript disabled won't be able to run any JavaScript, but once they turn it on it should have relatively good feature support -- I suspect the sort of people who know how to disable JavaScript aren't using software more than 5 years out of date.
> but once they turn it on it should have relatively good feature support How could they even know to tuen it on when all they get is an empty page?