9 ms·
!= would be a simple non-regex replacement, right? Or are there parts to the exploit hostname that aren’t a literal match?
by floatingatoll 5y ago
!= would be a simple non-regex replacement, right? Or are there parts to the exploit hostname that aren’t a literal match?
- tytso 5y agoThe reason why I used the regex match is because the attacker might try to add one or spaces as a prefix and/or suffix, e.g " metadata.google.internal " which wouldn't match "metadata.google.internal" but the spaces in /etc/hosts name would be ignored and still be effective in poisoning the /etc/hosts lookup for metadata.google.internal.