Hacker News Reader

Hacker News

Comment by JamieH | Hacker News Reader

Parent Full thread

JamieH

So uh. This works on a few websites. A couple I've found

http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=...

http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....

View on HN

Our dns lookup tool is safe from this: https://www.misk.com/tools/#dns/jamiehankins.co.uk

OH! Now I get it. Honestly, this is hilarious

Put your e-mail on your profile. The smart appsec groups, like Google's, would look at your hack as a resume. Seriously, who would have ever thought of XSS via DNS?

You could have just alert'd, too, but no. Harlem Shake. Bravo.

http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=... appears to have fixed it.

To those at work: exploited sites will autoplay music. Make sure your sound is muted or your headphones are in.

Beautifully done.

^^ hilarious :)

I'm guessing nobody else noticed the Rick Roll in there too?

As the script was just bouncing the search box at the start I a) assumed it was deliberate and b) expected them to start trying to sell me domains.

The rickroll was the first bit I noticed o_0

I appreciated the "allowfullscreen" option being thoughtfully included.

Am I the only one here that doesn't get what I should be looking for? I see the txt fields have google-site-verification and peniscorp but what is that doing?

They finally fixed it, but when this was first posted, the whois sites didn't do any sanitization of the TXT records, which meant that they'd just slap the record into the page. As the record included html saying, "hey, load this script from peniscorp", loading the page would let the script loaded there do various manipulations.

Nitpick: they should have been encoding the output not sanitising.

So like, what template library are these sites using that doesn't have basic XSS protection. :|

Probably basic PHP?

MXToolbox is a windows based app

Reply on news.ycombinator.com