dns

  • dig without dig

    curl -s -H 'host: dns.google.com' \
  'https://8.8.8.8/resolve?name=assets.github.com&type=NS' \
  | jq

  • Getting sneaky with DNS for SSRF Understanding how fundamental technologies work goes a long way ...

    Generally when I make http requests against a domain, I wouldn’t expect it to make requests on my localhost - but sometimes, just that happens. For getting sneaky with SSRF attacks you can have a DNS record point to 127.0.0.1. When a record pointing to 127.0.0.1 is resolved, your application will end up making requests 127.0.0.1. For experimentation, I used one of Rapid7’s free datasets, & found the domain volks-seat.de pointing 127.0.0.1. It never occurred to …