3 ms·

I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I

I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I think of offline activity. All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?

msla 7y ago
> All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner? This is how FreeDNS works: There's lots of domains which are donated to the project, and people can register subdomains of those domains and have them point to their own systems, with software to ensure the DNS records stay up-to-date even in the face of dynamic IP addresses. https://freedns.afraid.org/faq/ https://freedns.afraid.org/faq/
floatingatoll 7y ago
2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com. 2019: You replace blahblahblah and shut it down on Heroku 2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com. Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.