Last month ONsec_lab had discovered and reported about the same DNS issue in top web projects: live.com, facebook.com, yahoo.com, nokia.com, paypal.com, baidu.com, att.com and many others.
DNS linked few *.COMPANY.com domains to IP which doesn't belong to
COMPANY.
These addressed from Private Address Space 10/8, 172.16/12, 192.168/16 (look at http://tools.ietf.org/html/rfc1918, https://en.wikipedia.org/wiki/IPv4) and localhost 127.0.0.1.
Basically, this may be interpreted as information leakage from intranet of COMPANY. But it's obvious :)
This server-side issue can be exploited as a client-side vulnerability when attacker and victim are in the same private network:
This server-side issue can be exploited as a client-side vulnerability when attacker and victim are in the same private network:
I.e. local.COMPANY.com have A-record to 10.0.0.123
1. Attacker connects to any public network with address space from 10.0.0.0/8 or other which linked to any local.COMPANY.com domain.
2. Attacker adds to network interface on his computer address from A-record which linked to private address 10.0.0.123.
3. Attacker publishes on any resource link to local.COMPANY.com (for example - banner on any news-site). Like as classic CSRF/reflected XSS attack.
4. All users, who connected to the same network (1) and see banner (3) will make request to http://local.COMPANY.com, which actually will be made to computer of attacker. Browser will send cookies for *.COMPAMY.com in this request, because user make request to local.live.com.
In this case malicious user steal cookies.
What about protection?
Simple way is protect session cookies by Secure flag. This is facebook way. But anyway attacker can steal others non-Secure cookies. Also attacker in this case can do logout attack, because browsers have only 4Kb memory for all cookies which stored at all *.COMPANY.com domains. For this reason attacker can set many new cookies from local.COMPANY.com to delete all cookies from *.COMPANY.com and COMPANY.com scope.
Some examples:
./ccbill.com:192.168.169.170 backend.ccbill.com
./ccbill.com:192.168.13.127 internal.ccbill.com
./facebook.com:10.56.0.51 atlas.facebook.com
./facebook.com:10.56.0.69 hr.facebook.com
./facebook.com:10.60.0.29 lists.facebook.com
./facebook.com:10.170.0.4 ntp.facebook.com
./facebook.com:10.78.0.10 ntp.facebook.com
./facebook.com:10.60.0.195 sb.facebook.com
./facebook.com:10.170.0.4 time.facebook.com
./facebook.com:10.78.0.10 time.facebook.com
./facebook.com:10.56.0.7 xmail.facebook.com
./live.com:10.245.6.27 monitoring.live.com
./nokia.txt:10.113.1.11 guest.nokia.com
./nokia.txt:172.21.214.214 linux.nokia.com
./paypal.com:10.190.3.55 mx.paypal.com
./yahoo.com:10.72.164.31 i.yahoo.com
./yahoo.com:10.80.80.184 na.yahoo.com
./baidu.com:10.11.252.74 accounts.baidu.com
./baidu.com:10.81.7.51 ba.baidu.com
./baidu.com:172.18.100.200 bd.baidu.com
./baidu.com:10.36.155.42 bh.baidu.com
./baidu.com:10.36.160.22 bh.baidu.com
./baidu.com:10.38.19.40 bh.baidu.com
./baidu.com:10.42.7.24 bi.baidu.com
./baidu.com:10.44.64.20 bugs.baidu.com
./baidu.com:10.81.11.67 cd.baidu.com
./baidu.com:10.38.157.31 cdn.baidu.com
./baidu.com:10.26.7.93 cms.baidu.com
./baidu.com:10.26.137.29 com.baidu.com
./baidu.com:10.36.7.99 crm.baidu.com
./baidu.com:10.26.7.125 crm.baidu.com
./baidu.com:10.23.248.28 ct.baidu.com
./baidu.com:10.42.243.12 dc.baidu.com
./baidu.com:10.237.2.83 def.baidu.com
./baidu.com:10.65.211.94 dt.baidu.com
./baidu.com:172.18.0.180 ecom.baidu.com
./baidu.com:10.42.7.18 erp.baidu.com
./baidu.com:10.42.224.22 flow.baidu.com
./baidu.com:172.22.1.88 fw.baidu.com
./baidu.com:172.22.31.92 ga.baidu.com
./baidu.com:10.46.52.12 global.baidu.com
./baidu.com:10.42.58.42 global.baidu.com
./baidu.com:172.16.1.2 gw1.baidu.com
./baidu.com:10.240.31.12 h.baidu.com
./baidu.com:10.81.12.102 iq.baidu.com
./baidu.com:10.42.7.203 it.baidu.com
./baidu.com:10.42.7.54 km.baidu.com
./baidu.com:10.23.249.173 kr.baidu.com
./baidu.com:10.65.18.107 launch.baidu.com
./baidu.com:10.36.23.62 live.baidu.com
./baidu.com:10.26.40.19 live.baidu.com
./baidu.com:10.81.45.245 log.baidu.com
./baidu.com:10.26.39.14 log.baidu.com
./baidu.com:10.23.65.13 log02.baidu.com
./baidu.com:10.11.250.228 mirror.baidu.com
./baidu.com:10.26.140.39 ml.baidu.com
./baidu.com:10.81.15.138 monitor.baidu.com
./baidu.com:10.42.7.232 nl.baidu.com
./baidu.com:10.240.31.12 o.baidu.com
./baidu.com:10.26.3.48 ocean.baidu.com
./baidu.com:10.23.240.246 openview.baidu.com
./baidu.com:10.23.65.19 pe.baidu.com
./baidu.com:172.22.1.82 portal.baidu.com
./baidu.com:10.11.0.12 r2.baidu.com
./baidu.com:10.32.10.74 ra.baidu.com
./baidu.com:10.44.31.17 se.baidu.com
./baidu.com:10.42.7.217 security.baidu.com
./baidu.com:10.65.25.83 serv.baidu.com
./baidu.com:10.26.52.14 sms.baidu.com
./baidu.com:10.65.18.22 speed.baidu.com
./baidu.com:10.42.7.217 ssl.baidu.com
./baidu.com:10.46.28.36 tiger.baidu.com
./baidu.com:10.44.66.5 tn.baidu.com
./baidu.com:10.81.11.241 tool.baidu.com
./baidu.com:10.81.11.241 tools.baidu.com
./baidu.com:10.23.1.162 training.baidu.com
./baidu.com:10.23.248.87 ut.baidu.com
./baidu.com:10.48.40.58 va.baidu.com
./baidu.com:10.48.30.87 web.baidu.com
./baidu.com:10.65.19.212 win.baidu.com
./baidu.com:10.42.8.38 work.baidu.com
./baidu.com:10.81.211.74 ws.baidu.com
This is something that is occurring less. It appears that there has been a principal move in how banks and building social orders are respected nowadays. Cash Advance San-diego
ОтветитьУдалитьAs such, the greater part of the general population confront money related hardship which is reflected in their credit profile. This makes jump in getting credits.
ОтветитьУдалитьCash Advance Chicago
Nonetheless, you will have needed to consent to these expenses in the absolute starting point when you took out your payday advance.
ОтветитьУдалитьPayday Loans
In various rehabilitative or incapacitating conditions, non-intrusive treatment is vital to enable a patient to return to ordinary life. Once that happens, they can return to the matter of day by day life and winning a living.
ОтветитьУдалитьCar Title Loans Chicago
google account manager apk newest megadownloader manager frp bypass latest version
ОтветитьУдалитьthanks.. Frp Bypass Apk....apental calc apk
ОтветитьУдалитьเกมสล็อตออนไลน์ slotxo ฟรีเครดิต เล่นแล้วคุณจะรัก
ОтветитьУдалитьเล่นสล็อตxo วันนี้แจกเครดิตฟรี https://www.superslot999.com
Thanks It was useful and practical
ОтветитьУдалитьدانلود سریال هم گناه دانلود سریال هم گناه دانلود سریال هم گناه دانلود سریال هم گناه دانلود سریال هم گناه
Этот комментарий был удален автором.
ОтветитьУдалить
ОтветитьУдалитьPersonal website : sa gaming
.
Hello My name is Mr. J and I am nearly 28 years old. My birthday is on the 12th February. I am short and plump. I have dark hair and dark eyes. My friends say I smile all the time. I think I am a polite boy and I like looking after my younger brothers. In my spare time, I like to play football with my friends or play video games. At the weekend I like to watch movies or go swimming. When I am older, I want to be a footballer.