3 ms·
That's surprising to me. Any idea how it does it?
by TechBro8615 3y ago
That's surprising to me. Any idea how it does it?
- qmarchi 3y agoPretty easy. The website will request a specific DNS domain via XHR, something like: 49uz89psdfu89.dns.bgp.tools and will record the address that contacts the DNS server. A follow up request to the backend fills in the response.
- TechBro8615 3y agoInteresting, I guess that should have been obvious. I was going to suggest that it wouldn't detect cached lookups, but of course that's the point of the random subdomain. Still, there must be some topologies where this is not a reliable method of getting anything but the resolver closest to the nameserver. For example, if I have a recursive resolver running on my home network, and it resolves via 8.8.8.8, then this site will see 8.8.8.8 and not my home IP. (The same would be true even if my "internal" resolver were running on a public endpoint.) I assume this is a common fingerprinting technique. In theory, a privacy preserving DNS service could route its outbound requests through random IP addresses that do not correlate to the DNS server. Although I'm not sure how useful that would be since an adversary could enumerate all the associated addresses of a resolver by repeatedly looking up random domains and noting the external IP.
- i2shar 3y agoSee also: https://www.dnsleaktest.com/ https://www.dnsleaktest.com/