4 ms·
> ...embeds an XSS attack in the TXT record of a DNS entry which then renders into the output of a WHOIS service I'm not even mad, that's amazing.
by fredley 9y ago
> ...embeds an XSS attack in the TXT record of a DNS entry which then renders into the output of a WHOIS service
I'm not even mad, that's amazing.
- vim_wannabe 9y agoRemember kids: raw input, escape output.
- technion 9y agoThere was a particular domain that, when queried at most whois services, would play the harlem shake in your browser. It worked nearly everywhere that did such lookups.
- astura 9y agoIt was linked in the next sentence of TFA: https://www.youtube.com/watch?v=1anIUDvdCjY https://www.youtube.com/watch?v=1anIUDvdCjY The domain was forfun.net
- helb 9y agoThere's even a tool for it: https://wiki.skullsecurity.org/index.php?title=Dnsxss https://wiki.skullsecurity.org/index.php?title=Dnsxss
- guessmyname 9y agoI used to do this with because I found that some web performance scanners would usually forget to escape the content of the HTTP headers. After sending this domain [1] some of them would immediately execute the script. Feel free to send a HEAD request to this website so you can understand better, it's basically the same thing as with the TXT DNS records. [1] https://cixtor.com/ https://cixtor.com/