The DMZ

« first day (3416 days earlier) ← previous day next day → last day (1762 days later) »

MechMK1

11:06

Q: Can the Host Header be used to hide the existence of a service?

Imagine a web server running on 93.184.216.34, usually reachable via the public DNS entry example.com. Web servers usually allow the distinction of multiple "virtual" servers, based on the Host header received via the HTTP request. Now imagine the same web server would offer a different service ...

web-service

2 hours later…

ThoriumBR

12:39

@MechMK1 interesting case... and I believe it works better than most people think

MechMK1

Yeah. I mean, as long as it doesn't go via public dns, it should be pretty obscure

ThoriumBR

even if it does, if I ask my dns server about your domain, it will return NXDOMAIN. leaks the hostname but not the ip

kinda like leaking a password but not the username

MechMK1

Why? If you ask for example.com, you get a regular A record

the "secret" host never hits DNS at all. It'd just be done via the hosts file

ThoriumBR

if I ask for cx6wdffpuik997eljf6d878i6f3np4207ne30vyjsvhpra69 it returns NXDOMAIN

MechMK1

exactly, because it is not a valid domain

ThoriumBR

12:46

but on the dns log, there will an interesting entry about a domain cx6wdffpuik997eljf6d878i6f3np4207ne30vyjsvhpra69

MechMK1

True that

ThoriumBR

an admin locked at home with lots of free time may wonder why he is getting that strange name over and over... ask around, see your question, my answer...

what about scanning the whole internet?

MechMK1

What do you mean?

Oh, you mean an admin trying it?

Well, he might then reach the target, but with invalid certificates

if you do that with my server, it forwards you to my question

only works with http though

Try it

ThoriumBR

client certificates would protect it, but would do the same for a common domain too

if you use client certificates, the obscure domain not add much security

MechMK1

It's the security by design and some obscurity sprinkled ontop

Like disabling server headers

Doesn't protect you, but doesn't hurt you either

ThoriumBR

12:59

it's like having a secret door with a very secure lock, and a visible door with a very secure lock

MechMK1

Yeah, but the visible door springs to view immediately

ThoriumBR

if the door is visible or not is not what makes it secure, but the strong lock

MechMK1

The secrecy of the door may be a feature in itself

ThoriumBR

it's kinda like my personal server. ssh is not on port 22. it does not make it more secure, only decreases the automated attacks. if someone bruteforces my server, it will someday find the correct port

the security is from not being able to login with passwords, and I strapped googleauth pam module on it too, so the attacker would have to get my key AND my 2FA token

changing the port does little on the security

it even hurts me some times when I forget to change the port while connecting to it and ssh hangs waiting for the connection

MechMK1

It's even worse if you have a honeypot on SSH 22

Which does nothing except receive auth requests and give veeeery slow responses

ThoriumBR

13:05

in one server, I do (sshpot). and I have portsentry. and fail2ban.

MechMK1

I'm just a pleb. SSH on port 22 and pubkey auth

ThoriumBR

I use sslh (or sshl, I never remember) and it stays in port 443... so if I send an HTTPS request, it sends it to Apache. if it's an openvpn, it redirects to openvpn. if I ssh into it, it sends to sshd...

it's a nice addition, as most proxies allow CONNECT on port 443... little they know...

MechMK1

what the fuck is this abomination

ThoriumBR

github.com/yrutschle/sslh

MechMK1

Back in my days we used to have dedicated ports per protocol and WE LIKED IT!

Kids these days, no respect for traditions

paj28

13:08

About the web site question, ultimately you can put an auth token pretty much anywhere and it has a similar effect

My labs use an auth token in the host name, with wildcard DNS and SSL

MechMK1

@paj28 Yeah, I saw that being done with a cookie once

ThoriumBR

why dedicate ports if you can use only one port and have everything?

paj28

I didn't want to use cookies because they fiddle with cookies as part of the labs, so it could be confusing

MechMK1

If you had secret_feature=hfojshqjewtwjdvnsjbkjybxlgajgjaljhg, it would enable some secret features

paj28

Putting the token in the host name is the least aggro

MechMK1

13:09

I want that too

Just make a website that is full of easter eggs

paj28

My friend got a trip to New York over something similar

MechMK1

Then in the end start a massive ARG, all while denying that an ARG is happening

To the future reader: Welcome. There is no ARG. Go home.

paj28

hackerone.com/blog/h1-212-ctf-results

MechMK1

I'll have to look at it

8 hours later…

Luc

21:25

where does one report spam? security.stackexchange.com/users/220461/…

paj28

I think you'd have to accept a bad edit then flag the edited question. It's probaly rare, but slight SE design flaw. Should be a link to flag the edits.

I chatted to a db security guy earlier. We got onto the issue of smart db vs smart app, dumb db.

Of course, as a db sec guy he has a vested interest in the smart db model

He made an interesting point that even if you have an app front-end for end users

You'll have data scientists and people with partial administrative who need direct access