When internal hostnames are leaked to the clown
rachelbythebay.com
When internal hostnames are leaked to the clown
1–10 of 265 posts
Re: When internal hostnames are leaked to the clown
#2Pennywise found my hostname? We're cooked.
Re: When internal hostnames are leaked to the clown
#3Slightly surprised that this blog seems to have succumbed to inbound traffic.
Re: When internal hostnames are leaked to the clown
#4Slightly surprised that this blog seems to have succumbed to inbound traffic.
Opens fine for me
Re: When internal hostnames are leaked to the clown
#5I don’t understand. How could a GCP server access the private NAS?
I agree the web UI should never be monitored using sentry. I can see why they would want it, but at the very least should be opt in.
Re: When internal hostnames are leaked to the clown
#6Pennywise found my hostname? We're cooked.
Misconfigured clown - bad news indeed.
Re: When internal hostnames are leaked to the clown
#7Pennywise found my hostname? We're cooked.
You're IT, I'm IT, We're all IT.
Re: When internal hostnames are leaked to the clown
#8I don’t understand. How could a GCP server access the private NAS? I agree the web UI should never be monitored using sentry. I can see why they would want it, but at the very least should be opt in.
It said knocking, not accessing
also
> you notice that you've started getting requests coming to your server on the "outside world" with that same hostname.
Re: When internal hostnames are leaked to the clown
#9I don’t understand. How could a GCP server access the private NAS? I agree the web UI should never be monitored using sentry. I can see why they would want it, but at the very least should be opt in.
It couldn’t, but it tried.
Re: When internal hostnames are leaked to the clown
#10This highlights a huge problem with LetsEncrypt and CT logs. Which is that the Internet is a bad place, with bad people looking to take advantage of you. If you use LetsEncrypt for ssl certs (which you should), that hostname gets published to the world, and that server immediately gets pummeled by requests for all sorts of fresh install pages, like wp-admin or phpmyadmin, from attackers.