3 ms·

I like the idea of encoding the data. Or it can be like a URL shortener, where the metadata gets recorded, and a short hash is generated. It complicates the bac

I like the idea of encoding the data. Or it can be like a URL shortener, where the metadata gets recorded, and a short hash is generated. It complicates the back-end but allows for more comprehensive data storage, and eventual reporting. Regarding custom DNS software, I might draw from this excellent write-up featured on HN recently: http://5f5.org/ruminations/dns-debugging-over-http.html http://5f5.org/ruminations/dns-debugging-over-http.html

0x0 14y ago
Nice find! Also, it'd be interesting to just crank the log level to maximum on a normal piece of DNS software, and post some links around in IM clients and elsewhere, just to see if anything anywhere kicks in. The experiment could be repeated (on different subdomains) with a more clever implementation tricks later.
- MiguelHudnandez 14y ago
  I ended up just setting up bind with a wildcard entry, and setting its log level for queries to debug. It is working now, but I need to build a little web app to generate the unique links. Also only one DNS server is running at the moment. I can't wait to send some around in facebook messages and IMs. Here's a maiden honeypot link: http://hn0001.hnypot.info/Welcome-Internets http://hn0001.hnypot.info/Welcome-Internets! ...Though posting it publicly nearly guarantees I will see a hit, I can at least see if code running on HN resolves it immediately.
  - MiguelHudnandez 14y ago
    I ended up just setting up bind with a wildcard entry, and setting its log level for queries to debug. It is working now, but I need to build a little web app to generate the unique links. Also only one DNS server is running at the moment. I can't wait to send some around in facebook messages and IMs. Here's a maiden honeypot link: http://hn0001.hnypot.info/Welcome-Internets http://hn0001.hnypot.info/Welcome-Internets! ...Though posting it publicly nearly guarantees I will see a hit, I can at least see if code running on HN resolves it immediately. Edit: There is activity coming in on that name, but mostly it is from browsers pre-loading DNS to prepare for the next potential pageview. My browser did this (chrome on Mac). I suppose that is a form of information disclosure we often overlook. On a page you can inject a link into, you can get some very basic analytics. In the 15 minutes following the posting of that link, there have been zero clicks, 36 IPv4 lookups, 6 IPv6 lookups.

0x0 14y ago

Nice find! Also, it'd be interesting to just crank the log level to maximum on a normal piece of DNS software, and post some links around in IM clients and elsewhere, just to see if anything anywhere kicks in. The experiment could be repeated (on different subdomains) with a more clever implementation tricks later.

MiguelHudnandez 14y ago
I ended up just setting up bind with a wildcard entry, and setting its log level for queries to debug. It is working now, but I need to build a little web app to generate the unique links. Also only one DNS server is running at the moment. I can't wait to send some around in facebook messages and IMs. Here's a maiden honeypot link: http://hn0001.hnypot.info/Welcome-Internets http://hn0001.hnypot.info/Welcome-Internets! ...Though posting it publicly nearly guarantees I will see a hit, I can at least see if code running on HN resolves it immediately.
- MiguelHudnandez 14y ago
  I ended up just setting up bind with a wildcard entry, and setting its log level for queries to debug. It is working now, but I need to build a little web app to generate the unique links. Also only one DNS server is running at the moment. I can't wait to send some around in facebook messages and IMs. Here's a maiden honeypot link: http://hn0001.hnypot.info/Welcome-Internets http://hn0001.hnypot.info/Welcome-Internets! ...Though posting it publicly nearly guarantees I will see a hit, I can at least see if code running on HN resolves it immediately. Edit: There is activity coming in on that name, but mostly it is from browsers pre-loading DNS to prepare for the next potential pageview. My browser did this (chrome on Mac). I suppose that is a form of information disclosure we often overlook. On a page you can inject a link into, you can get some very basic analytics. In the 15 minutes following the posting of that link, there have been zero clicks, 36 IPv4 lookups, 6 IPv6 lookups.