Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TXT Record XSS

who.is

Post reply on HN
Print view View original

81–90 of 236 posts

Re: TXT Record XSS

#81

Post by jonknee »

finnn wrote: post #47
ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

How big is it? If you put up a torrent I'll seed it...

Likewise, I have a gigabit internet connection and plenty of extra space.

Re: TXT Record XSS

#82

Post by dsl »

mrb wrote: post #57

I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…

Malware has been putting updates and command and control instructions inside DNS records for a while now, so they get the benefits you mention as well as continued availability even when the original authoritative servers are taken down.

Re: TXT Record XSS

#83

Post by jonknee »

Thaxll wrote: post #43

It has nothing to to do with TXT record, it's just the website that render html. It could be any source.

It has everything to do with the TXT record... Every XSS could be summed up with "just the website that renders HTML", but that's pretty much the point. TXT records aren't often thought of as input and as you can see several sites made that mistake of assumption.

Re: TXT Record XSS

#84

Post by michaelmior »

mrb wrote: post #57

I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…

If you want to access this in a web browser, you still need some server which speaks HTTP and makes the DNS request and forwards the result to the browser. So you're really not saving much there. In fact, you'll have higher latency since you now need HTTP plus an extra DNS request. Unless of course browsers support dns://...

Re: TXT Record XSS

#85

Post by jsmthrowaway »

JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

Put your e-mail on your profile. The smart appsec groups, like Google's, would look at your hack as a resume. Seriously, who would have ever thought of XSS via DNS?

You could have just alert'd, too, but no. Harlem Shake. Bravo.

Re: TXT Record XSS

#86

Post by Havvy »

swartkrans wrote: post #75
JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

So like, what template library are these sites using that doesn't have basic XSS protection. :|

Probably basic PHP?

Re: TXT Record XSS

#87

Post by aw3c2 »

ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

https://archive.org please!

Re: TXT Record XSS

#88

Post by giancarlostoro »

JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

I'm guessing nobody else noticed the Rick Roll in there too?

Re: TXT Record XSS

#89

Post by ryan-c »

aw3c2 wrote: post #87
ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

https://archive.org please!

Do you know anyone there or anything about the process of getting something hosted there? I can burn the data to a DVD and snail mail it to them (or even drop it off in SF).
Post reply on HN