5 ms·

No expert, but even example.com isn't totally safe, right? According to the RFC (https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761), while

by aidos 6y ago

No expert, but even example.com isn't totally safe, right? According to the RFC (https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761), while these domains are reserved, nothing should treat them specially, so there's nothing to stop people having them routed somewhere else at the DNS level.

gruez 6y ago
AFAIK the domain is controlled by the IANA, so it's probably not too big of a security risk. If you really want to be paranoid you can set the site to be 0.0.0.0 or attacker.invalid.
- jefftk 6y ago
  attacker.invalid is good. So are <anything>.invalid, <anything>.test, or <anything>.example. They're all reserved and don't route.
  - voxic11 6y ago
    Maybe on your system, but there is nothing in the standards which forbids them from being routable.
    - gruez 6y ago
      But by default they won't be routable. I guess you can shoot yourself in the foot and have entries in your /etc/hosts point to your attacker's site, but that's kind of hacking yourself.
      - deleted 6y ago
        [deleted]
    - morelisp 6y ago
      The standard forbids (well, "should nots", which is the best you get most of the time) .invalid. from routing. It's supposed to be filtered at the nameserver API level and everything after that (cached DNS, authoritative DNS, registrar, etc.)
      - voxic11 6y ago
        Which RFC is that? There is nothing like that in the original RFC that defined the .invalid gtld. https://tools.ietf.org/html/rfc2606 https://tools.ietf.org/html/rfc2606
        morelisp 6y ago
        RFC 6761, which is linked both upthread and as a supercession in the header of your own link.
- marcan_42 6y ago
  0.0.0.0 is localhost, which is a great way to allow other software running on your computer to take the data and send it elsewhere. It's not a great IP address to use for "invalid". Yes, 0.0.0.0 really resolves to 127.0.0.1 on Linux at least. Try it.
  - oefrha 6y ago
    Not saying 0.0.0.0 should be used in this case, but if you have data sniffing software listening on port 80 or 443 without your knowledge (or really any port at all, but especially a privileged port), you probably have much bigger things to worry about than some ad hoc PoC sending data there.
- gramakri 6y ago
  Or use .local
  - cat199 6y ago
    .local is a bit problematic since there are RFC's explicitly stating this should only be resolved by multicast DNS which has its own security issues and also fallback lookup is somewhat undefined.
LinuxBender 6y ago
I agree. In my opinion, it would be useful if every browser and API client did something special with that domain. To the best of my knowledge, this is not the case. AFAIK I could easily plug that domain into my unbound servers which my SSL MITM proxy utilize and route traffic to it. If the client is not aware of a special domain, then you are dependent on the infrastructure to behave in a predictable manor. Attackers can alter that behavior.

by aidos 6y ago

gruez 6y ago

AFAIK the domain is controlled by the IANA, so it's probably not too big of a security risk. If you really want to be paranoid you can set the site to be 0.0.0.0 or attacker.invalid.

jefftk 6y ago
attacker.invalid is good. So are <anything>.invalid, <anything>.test, or <anything>.example. They're all reserved and don't route.
- voxic11 6y ago
  Maybe on your system, but there is nothing in the standards which forbids them from being routable.
  - gruez 6y ago
    But by default they won't be routable. I guess you can shoot yourself in the foot and have entries in your /etc/hosts point to your attacker's site, but that's kind of hacking yourself.
    - deleted 6y ago
      [deleted]
  - morelisp 6y ago
    The standard forbids (well, "should nots", which is the best you get most of the time) .invalid. from routing. It's supposed to be filtered at the nameserver API level and everything after that (cached DNS, authoritative DNS, registrar, etc.)
    - voxic11 6y ago
      Which RFC is that? There is nothing like that in the original RFC that defined the .invalid gtld. https://tools.ietf.org/html/rfc2606 https://tools.ietf.org/html/rfc2606
      - morelisp 6y ago
        RFC 6761, which is linked both upthread and as a supercession in the header of your own link.
marcan_42 6y ago
0.0.0.0 is localhost, which is a great way to allow other software running on your computer to take the data and send it elsewhere. It's not a great IP address to use for "invalid". Yes, 0.0.0.0 really resolves to 127.0.0.1 on Linux at least. Try it.
- oefrha 6y ago
  Not saying 0.0.0.0 should be used in this case, but if you have data sniffing software listening on port 80 or 443 without your knowledge (or really any port at all, but especially a privileged port), you probably have much bigger things to worry about than some ad hoc PoC sending data there.
gramakri 6y ago
Or use .local
- cat199 6y ago
  .local is a bit problematic since there are RFC's explicitly stating this should only be resolved by multicast DNS which has its own security issues and also fallback lookup is somewhat undefined.

LinuxBender 6y ago

I agree. In my opinion, it would be useful if every browser and API client did something special with that domain. To the best of my knowledge, this is not the case. AFAIK I could easily plug that domain into my unbound servers which my SSL MITM proxy utilize and route traffic to it. If the client is not aware of a special domain, then you are dependent on the infrastructure to behave in a predictable manor. Attackers can alter that behavior.