Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TXT Record XSS

who.is

Post reply on HN
Print view View original

41–50 of 236 posts

Re: TXT Record XSS

#41

Post by eli »

pkinsky wrote: post #28
SEJeff wrote: post #17

From any Linux (or probably OS X) workstation / server, you can run the command "host -t TXT jaimehankins.co.uk" ie: $ host -t TXT jamiehankins.co.uk ;; Truncated, retrying in TCP mode. jamiehankins.co.uk descriptive text " " jamiehankins.co.uk descriptive text "v=spf1 include:spf.mandrillapp.com ?all" jamiehankins.co.uk descriptive text " " jamiehankins.co.uk descriptive text "google-site-verification=nZUP4BagJAjQZO…

This is hilarious, but what's up with this line? >jamiehankins.co.uk descriptive text "v=spf1 include:spf.mandrillapp.com ?all" Why is mandrillapp.com (tranactional email startup) included?

It's an SPF record. By adding your authorized mail servers to your DNS, recipient mail servers can "verify" that a given server is supposed to sending mail for your domain.

Re: TXT Record XSS

#44

Post by apetresc »

ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

How large is it, ballpark?

Re: TXT Record XSS

#45

Post by jxf »

Thaxll wrote: post #43

It has nothing to to do with TXT record, it's just the website that render html. It could be any source.

It's related because it's not conventionally thought of as user input that needs to be sanitized (but, of course, it should be).

Re: TXT Record XSS

#46

Post by TallboyOne »

xenophonf wrote: post #14
AsakiIssa wrote: post #7

Wasn't expecting that at all! Had several tabs opened and was really confused for a few seconds while I tried to find the tab with 'youtube on autoplay'. Firefox needs to show the 'play' icon for the audio tag.

Stuff like this is why NoScript and RequestPolicy were invented.

For making your life living hell in the name of overbearing security measures.

Re: TXT Record XSS

#47

Post by finnn »

ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

How big is it? If you put up a torrent I'll seed it...

Re: TXT Record XSS

#48

Post by tedunangst »

kehrlann wrote: post #18

This is hilariousy, but could this potentially be a real threat to anything ?

One can imagine that I trust who.is and will click on links that go there, but now it can redirect me to an evil site that will attempt to exploit my browser.
Post reply on HN