I opened this link on my Android's Chrome browser. The top search text input started wildly convulsing. First I thought the post was about that. But I didn't really get what this is about.
TXT Record XSS
211–220 of 236 posts
Re: TXT Record XSS
#212I opened this link on my Android's Chrome browser. The top search text input started wildly convulsing. First I thought the post was about that. But I didn't really get what this is about.
i don't really get it either
Re: TXT Record XSS
#213I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
"Again, I am only half serious" (said two times...) Why say that at all? Is it a way to fend off ridicule? Or does this show a lack of confidence in the idea and what you are saying? Reminds me of comments that start "Am I the only one who thinks that..." I've gotten out of the habit of apologizing for things that I say or prefacing them with phrases such as that. The reason is that I found that it was a lazy way to…
Because two half serious make a full serious.
Re: TXT Record XSS
#214Earlier quoted context omitted.
I hope you're not still talking cruise ships here! Those folks are often paying high prices by the minute or by the megabyte for access: you'd be pretty literally stealing from your neighbors in that situation. (The moral issue for pay-by-the-day systems is one step further removed, but I think it's still real.)
802.1x covers access control to networks. MAC addresses are not for access control. Not that a court would agree with my logic, of course.
Doesn't really matter - it might (!) be legal, but it is immoral (if they really are paying by MB).
Re: TXT Record XSS
#215Earlier quoted context omitted.
802.1x covers access control to networks. MAC addresses are not for access control. Not that a court would agree with my logic, of course.
Yeah, you might have a tough time explaining to the judge that Media Access Control addresses are not for access control.
In this context "access control" doesn't mean what you think it does. It refers to multiplexing the communications of multiple devices over a single shared communications medium, as in "controlling" (arbitrating) shared access to the radio spectrum. It has no relationship to network authorization or authentication and provides no security whatsoever.
http://en.wikipedia.org/wiki/Channel_access_method
Calling it "access control" has always been confusing which is why people started calling it Machine Address Code or Ethernet Hardware Address instead.
Re: TXT Record XSS
#216Who.is have fixed it now, but you can still see it in action over at archive.org
https://web.archive.org/web/20140918191824/http://who.is/dns...
Re: TXT Record XSS
#217Earlier quoted context omitted.
Am I the only one here that doesn't get what I should be looking for? I see the txt fields have google-site-verification and peniscorp but what is that doing?
They finally fixed it, but when this was first posted, the whois sites didn't do any sanitization of the TXT records, which meant that they'd just slap the record into the page. As the record included html saying, "hey, load this script from peniscorp", loading the page would let the script loaded there do various manipulations.
Nitpick: they should have been encoding the output not sanitising.
Re: TXT Record XSS
#218Who.is have fixed it now, but you can still see it in action over at archive.org https://web.archive.org/web/20140918191824/http://who.is/dns...
oh my god, it's even more entertaining with the wayback machine's page header.
Re: TXT Record XSS
#219Come on people, this is so basic. If you didn't generate the data, don't display it on your web page without filtering it. It blows my mind that this isn't just everyone's default.
Yeah, nothing clever at all. Tons of ways for user input, and this one just yet another one.
Re: TXT Record XSS
#220XSS on a shitty website not doing trivial sanitization gets 900 points on HN, oh guys you are disappointing me so much.