isn't this technically illegal to demonstrate haha?
Why on earth would it be illegal?
What SHOULD be illegal is not sanitizing all inputs.
TXT Record XSS
31–40 of 236 posts
Re: TXT Record XSS
#32Re: TXT Record XSS
#33Given how many whois sites cache results, I wonder how many of them are also vulnerable to SQL injections...
Re: TXT Record XSS
#34I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it.
Edit: I found my data and have a grep running on it, will share what turns up.
Edit2: Somewhat less exciting than I remember:
$ fgrep -- '>' *
x.x.101.130.csv:1298607746,155.92.101.130,.nebula.msoe.edu.
x.x.110.35.csv:1298587462,41.191.110.35,www.ahnigeria.org\032" rel="nofollow">http://www.ahnigeria.org/>.
x.x.126.67.csv:1298594206,75.127.126.67,\032>.
x.x.229.74.csv:1298608599,139.78.229.74,.suites.osuit.edu.
x.x.39.239.csv:1298594005,129.89.39.239,.uits.uwm.edu.
x.x.49.198.csv:1298613894,195.164.49.198,test.str!\@#\$%^&*\(\)}{\":]['>x.x.49.199.csv:1298613720,195.164.49.199,test.str
end.domain.test.pl.
x.x.49.206.csv:1298603066,195.164.49.206,test.str
omain.test.pl.
x.x.88.109.csv:1298606801,95.211.88.109,ilo.>.88.211.95.in-addr.arpa.
Re: TXT Record XSS
#35Wish there was a warning, because I accidentally clicked this link in class just now.
Re: TXT Record XSS
#36Clever. I didn't get it at first. Never trust user input. Edit: See http://www.dnswatch.info/dns/dnslookup?la=en&host=jamiehanki... for the actual code.
> Never trust user input. Never trust any input. I think this is a case where people assume that is isn't pure user input because is would have already been parsed/checked/verified. "Oh, its in the DNS system so it must be safe" is worse then "well, it came from our database so it should be fine". Don't even trust something coming out of your own database. You never know what various input checking bugs might have ac…
In addition to "never trust user input";
Never trust your program's output
You should have two sets of sanitization, one that sanitizes incoming data, and one that sanitizes outgoing data.
Re: TXT Record XSS
#37Earlier quoted context omitted.
Why on earth would it be illegal?
dam, that got downvoted into oblivion haha. honest question... although i dont believe it should be, a third party injecting javascript to demonstrate an exploit might be...
Anybody saying "this is illegal" should be required to cite the law they think is broken and explain why the act in question violates that law.
Re: TXT Record XSS
#38Earlier quoted context omitted.
Why on earth would it be illegal?
dam, that got downvoted into oblivion haha. honest question... although i dont believe it should be, a third party injecting javascript to demonstrate an exploit might be...
He hasn't injected anything. It's just his public DNS record that this page has chosen to display without sanitizing.
Re: TXT Record XSS
#39The most clever exploit of XSS I've ever seen. Beautiful. Bravo.
Re: TXT Record XSS
#40This is hilariousy, but could this potentially be a real threat to anything ?
idk why youre getting downvoted because it's a good question and people need to ask more security questions.
Any website I can inject malicious javascript into, I can steal your cookies from (assuming the httponly flag isn't set on the cookie).
If you were logged into one of these whois sites and they didnt have the httponly flag set on your auth cookie, an attacker could send you to a page on the site that contains malicious javascript that could phone home with your auth cookie, letting the attacker hijack your session.
You can defend your own websites from these kinds of attacks by setting up a Content Security Policy and using the 'httponly' flag on auth cookies.