Comments on: [not] Protecting web sites and services from DNS rebinding attacks https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/ Open information and technology. Mon, 03 Sep 2007 14:30:57 +0000 hourly 1 http://wordpress.com/ By: top10webhosting https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-698 Mon, 03 Sep 2007 14:30:57 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-698 Hmm.. I am getting the following error.

Please wait for 15 seconds.
f1()
ERROR: Access is denied.
ERROR: http://1188829961575.jumperz.net/exploits/dnsp3.jsp?address=127.0.0.1
ERROR: 50

What does it mean ?

]]> By: Dmitry https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-697 Fri, 03 Aug 2007 19:04:33 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-697 This component lets you protect Java web applications from
DNS rebinding: http://www.servletsuite.com/servlets/hostflt.htm

]]> By: Dan Weber https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-696 Thu, 02 Aug 2007 18:40:16 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-696 This works because jumperz.com’s bind is sending back incorrect DNS responses, yes?

]]> By: Christian Matthies https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-695 Thu, 02 Aug 2007 18:14:52 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-695 Well, keep in mind that the host header can be spoofed with Anti Anti Anti DNS Pinning also. Check out http://christ1an.blogspot.com/2007/07/dns-pinning-explained.html, an article I wrote on this matter a few weeks ago.

]]> By: david https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-694 Thu, 02 Aug 2007 00:25:53 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-694 stand: I think that the port-80 limit is just a feature of the jumperz.net demo, though you would probably have to stay on the same port as the original web page. I’ll have to look at the exploit in more detail.

]]> By: University Update - Firefox - Protecting web sites and services from DNS rebinding attacks https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-693 Thu, 02 Aug 2007 00:23:40 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-693 […] Contact the Webmaster Link to Article firefox Protecting web sites and services from DNS rebinding attacks » Posted at […]

]]> By: stand https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-692 Wed, 01 Aug 2007 23:14:30 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-692 David, it’s not immediately apparent to me whether this exploit will relay services that are not hosted on port 80. I don’t see why is shouldn’t, but the jumperz.net page you link to doesn’t work with non-80 ports.

]]> By: » Protecting web sites and services from DNS rebinding attacks https://quoderat.megginson.com/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-691 Wed, 01 Aug 2007 21:51:40 +0000 http://www.megginson.com/blogs/quoderat/2007/08/01/protecting-web-sites-and-services-from-dns-rebinding-attacks/#comment-691 […] Original post by david […]

]]>