Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TXT Record XSS

who.is

Post reply on HN
Print view View original

111–120 of 236 posts

Re: TXT Record XSS

#111

Post by jlgaddis »

ryan-c wrote: post #34

I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…

Put it somewhere I can grab it and I'll be happy to host it (I do some work for an ISP and have my own servers in the datacenter). Email is in profile.

Re: TXT Record XSS

#112

Post by jbert »

0x0 wrote: post #69
marcosdumay wrote: post #61

Earlier quoted context omitted.

Use the Kitchen Sink[1] record type. It's more appropriated than TXT. [1] https://tools.ietf.org/html/draft-ietf-dnsind-kitchen-sink-0...

I saw "ASN.1" in the draft and immediately thought "over-engineered".

When bytes count (and they often don't, but in this case they probably do), what would be your preferred system? And what do you see as your favoured approach's main advantage(s) over ASN.1/BER?

Re: TXT Record XSS

#113

Post by MiguelHudnandez »

himanshuy wrote: post #62

What's up with the search box?

That is from topkek.js. Pretty clever! It plays the harlem shake song. One element shakes by itself until the second phase of the song, then lots of other elements start shaking.

Cleverness aside, it is practical when looking for XSS vulnerabilities because it's very obvious when you've succeeded in injecting your code.

Re: TXT Record XSS

#114

Post by kazinator »

Since there is very little discussion in the link, pardon me for stating what may be obvious to some, but not necessarily everyone.

The point here is that:

1. DNS TXT records can contain HTML, including scripts and whatever.

2. Domain registrants can publish arbitrary TXT records.

3. TXT records can appear in pages generated by web sites which serve, for instance, as portals for viewing domain registration information, including DNS records such as TXT records.

4. Thus, such sites are vulnerable to perpetrating cross-site-script attacks (XSS) on their visitors if they naively paste the TXT record contents into the surrounding HTML.

5. The victim is the user who executes a query which finds the malicious domain which serves up the malicious TXT record that is interpolated into the displayed results. The user's browser executes the malicious code.

Thus, when you are generating UI markup from pieces, do not trust any data that is pulled from any third-party untrusted sources, including seemingly harmless TXT records.

Re: TXT Record XSS

#115

Post by aroch »

jameshart wrote: post #106
oddtarball wrote: post #66

Earlier quoted context omitted.

Meh, interesting thought, but a few things come to mind: - It could take multiple days to update the website for the entire world - It would be very easy to spoof the entire site - It would probably slow down the rest of the queries the DNS server would be responding to at the time. Also, updating DNS can be a pain for sites that aren't managing their own records.

Used to work in the DNS business. "It will take up to 24 hours to propagate" is a way to manage expectations and prevent support calls from coming in within the first 24 hours after a DNS change, not a reflection of actual DNS propagation times.

I don't know how things work now, but at least a few years ago there were plenty of DNS server that would take basically the full 48hours to update, regardless of TTL.

Re: TXT Record XSS

#116

Post by astrodust »

giancarlostoro wrote: post #88
JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

I'm guessing nobody else noticed the Rick Roll in there too?

I appreciated the "allowfullscreen" option being thoughtfully included.

Re: TXT Record XSS

#117

Post by astrodust »

vlunkr wrote: post #19
AsakiIssa wrote: post #7

Wasn't expecting that at all! Had several tabs opened and was really confused for a few seconds while I tried to find the tab with 'youtube on autoplay'. Firefox needs to show the 'play' icon for the audio tag.

For what it's worth, Chrome tells you which tab audio is playing from, it's nice.

Now if only Chrome had a mute button in the same spot to shut it up.

Re: TXT Record XSS

#118

Post by fsniper »

UweSchmidt wrote: post #92
fsniper wrote: post #73

Earlier quoted context omitted.

It's really a hell. Average website over there is using at least 3 - 4 external domains for css, js, fonts and so. Getting a working website without nearly whitelisting many of them is highly improbable right now.

Yes but you gain a lot of interesting information about what's going on, plus you are back in control. Whitelist places you trust. Keep things blocked that you don't like. If that breaks the experience, walk.

Sure. I used script blockers for a while. But after having to whitelist a huge number of them and loosing very long and precious time, I gave in. I do not put sensitive and important data on my computer. (Actually I was not doing that for a very long time even before giving in.) I always work on remote hosts.

Therefore I treat my desktop as a security research one. Of course I would not do that on my desktop I were really working with crackme binaries ;)

Re: TXT Record XSS

#119

Post by BuildTheRobots »

giancarlostoro wrote: post #88
JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

I'm guessing nobody else noticed the Rick Roll in there too?

As the script was just bouncing the search box at the start I a) assumed it was deliberate and b) expected them to start trying to sell me domains.

The rickroll was the first bit I noticed o_0

Re: TXT Record XSS

#120

Post by finnn »

_RPM wrote: post #65
wittrock wrote: post #60

Earlier quoted context omitted.

That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.

Oh I see. This makes sense. This doesn't seem challenging to prevent. A simple replacement of characters on the HTML entity table would have prevented this instead of putting arbitrary text onto standard output.

Correct. The purpose of this post is to demonstrate yet another class of website that does not validate user input.
Post reply on HN