Xss via dns

delfinom

From reddit:
[s]http://who.is/dns/jamiehankins.co.uk[/s] (Fixed now)
Next site that is vulnerable!
http://mxtoolbox.com/SuperTool.aspx?action=txt%3Ajamiehankins.co.uk&run=toolpage
Edit, another site!

SSL Checker for Comodo, Symantec, Thawte, DigiCert, GeoTrust, & RapidSSL

http://www.reddit.com/r/programming/comments/2gs2c3/dns_txt_record_xss/

tarunik

Now that is something to behold.

Matches

Nice. Now profile it using google analytics in the DNS text/script.

chubertdev

Isn't that SOP for ISPs these days?

Maciejasjmj

@tarunik said:

Now that is something to behold.

Needs more fa-spin.

presidentsdaughter

Oh boy...
http://mxtoolbox.com/SuperTool.aspx?action=txt%3Ajamiehankins.co.uk&run=toolpage# is worse even.. It seems each time a new instance is added to the page, making it slowing to a crawl

Arantor

It would appear to have been fixed now though...?

blakeyrat

The title is pretty misleading here. It's just Yet Another Website Doesn't Sanitize Freeform User Input bug. Nothing inherent in the DNS system.

Arantor

Correct, but the delivery method - via DNS - is definitely unusual. I wonder how many WHOIS sites are actually vulnerable.

delfinom

It's not misleading. I said via.

Webster dictionary defines via as:
1
: by way of
2
: through the medium or agency of;

Definition of VIA

by way of; through the medium or agency of; also : by means of… See the full definition

If I said XSS IN DNS, then that's misleading.

delfinom

Fun fact, who.is is using PHP. You can confirm this by going to "index.php" and getting their search page but if you type index2.php you get a 404 error.

So somebody learned:

Never trust any input
What is htmlentities?

delfinom

O look at that, an SSL cert site is vulnerable

SSL Checker for Comodo, Symantec, Thawte, DigiCert, GeoTrust, & RapidSSL

Arantor

@delfinom said:

Fun fact, who.is is using PHP. You can confirm this by going to "index.php" and getting their search page but if you type index2.php you get a 404 error.

So somebody learned:

Never trust any input

What is htmlentities?

I'd settle for htmlspecialchars() personally, don't need to wrangle everything into entities.