TXT Record XSS

rbinv wrote: post #3

Clever. I didn't get it at first. Never trust user input. Edit: See http://www.dnswatch.info/dns/dnslookup?la=en&host=jamiehanki... for the actual code.

> Never trust user input.

Never trust any input. I think this is a case where people assume that is isn't pure user input because is would have already been parsed/checked/verified.

"Oh, its in the DNS system so it must be safe" is worse then "well, it came from our database so it should be fine". Don't even trust something coming out of your own database. You never know what various input checking bugs might have accidentally let in over time.

Re: TXT Record XSS

#7

Post by AsakiIssa » Thu, Sep 18, 2014, 5:03 PM UTC

Wasn't expecting that at all! Had several tabs opened and was really confused for a few seconds while I tried to find the tab with 'youtube on autoplay'.

Firefox needs to show the 'play' icon for the audio tag.

Re: TXT Record XSS

#8

Post by iamwil » Thu, Sep 18, 2014, 5:04 PM UTC

How does this work?

Re: TXT Record XSS

#9

Post by jpinkerton88 » Thu, Sep 18, 2014, 5:05 PM UTC

JamieH wrote: post #4

So uh. This works on a few websites. A couple I've found http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

Beautifully done.

Re: TXT Record XSS

#10

Post by JamieH » Thu, Sep 18, 2014, 5:07 PM UTC

iamwil wrote: post #8

How does this work?

The TXT record isn't being sanitized so it just echos out the script tag which then loads the JS file.