fsecurelabs / dref Goto Github PK
View Code? Open in Web Editor NEWDNS Rebinding Exploitation Framework
DNS Rebinding Exploitation Framework
Want to build the dref-cli binary on tagged commits:
https://blog.questionable.services/article/build-go-binaries-travis-ci-github/
Should check if users are passing a Content-Type header when calling the framework's and network.post()
to allow users to post arbitrary content (JSON, octet-stream etc.)
The first request after a rebind will occasionally still hit dref instead of the target.
I think a one or two second delay before resolving triggerRebind()
could solve this.
The dns
app can be dockerized.
The image should be pushed to Dockerhub on tag builds.
At the moment we'll keep the configuration loading as is (YAML) but in the future we should load required params (address and domain) from env vars.
2.15.0
to 2.16.0
.This version is covered by your current version range and after updating it in your project the build failed.
eslint-plugin-import is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.
The new version differs by 4 commits.
9bac44e
bump to v2.16.0
d305f6a
use proper rest arg instead of [].slice
e72a336
fix #1266 by moving closure creation out of parsing scope (#1275)
1ec80fa
Fix for #1256 (#1257)
See the full diff
There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.
Your Greenkeeper Bot 🌴
Only ./dref/dns/
has test cases at the moment.
Adding tests across the repo is in progress.
dref-cli should offer ability to install and set up dref on a remote host:
$ dref install -u root -h 1.2.3.4 -d attacker.com
which git
which docker
which docker-compose
git clone dref
export $DREF_MONGO_HOST=mongo
export $DREF_DOMAIN=attacker.com
export $DREF_ADDRESS=1.2.3.4
docker-compose up
Shields currently pointing to another repo. Waiting on integrations to update URLs.
Proxies can mess with the tool's capabilities (or lead to interesting findings?).
If a user is behind a proxy, the dref in-browser payloads won't be able to hit services that are accessible to the user workstation if the proxy can't hit them.
TL;DR the context for attacks becomes the context of the proxy, not the workstation.
As a starter, it would be nice to just detect when the user is behind a proxy.
Maybe some ideas here:
https://www.blackhat.com/docs/us-14/materials/us-14-Williams-I-Know-Your-Filtering-Policy-Better-Than-You-Do.pdf
https://www.blackhat.com/docs/us-14/materials/us-14-Williams-I-Know-Your-Filtering-Policy-Better-Than-You-Do-wp2.pdf
Hello,
I was wondering if it would be possible to add support to rebind a domain to a cname
. That would allow an attacker to access some internal hosts without knowing the internal IP address, p.e. wiki.companydomain.com
.
This technique is described in this paper:
https://crypto.stanford.edu/dns/dns-rebinding.pdf
Spidering the Intranet.
The attacker need not specify
the target machine by IP address. Instead, the attacker
can guess the internal host name of the target, for example
hr.corp.company.com, and rebind attacker.com to a CNAME
record pointing to that host name. The client’s own recursive DNS resolver will complete the resolution and return
the IP address of the target. Intranet host names are often
guessable and occasionally disclosed publicly [30, 9]. This
technique obviates the need for the attacker to scan IP addresses to find an interesting target but does not work with
the multiple A record technique described in Section 3.1.
https://sinister.ly/Thread-DNS-Rebinding-Attack
i would really like to read your response .
Thanks
wish you a good day :)
Implement a primitive version of the dref-cli, probably using golang (ie: single compiled binary to download to admin dref from a machine)
targets example
$ dref get targets
NAME SCRIPT HANG FASTREBIND ARGS
sysinfo sysinfo false false {json snippet as string (ie: 30 chars)}
$ dref get target sysinfo
{raw json formatted}
logs example
$ dref get logs --target sysinfo
...
$ dref get log 507f1f77bcf86cd799439011
...
5.4.13
to 5.4.14
.This version is covered by your current version range and after updating it in your project the build failed.
mongoose is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.
The new version differs by 18 commits.
35b90d2
chore: release 5.4.14
8dc47a5
docs(schema): add examples for remaining functions
764735b
fix(documentarray): report validation errors that occur in an array subdoc created using create()
and then set()
3fec456
test(documentarray): repro #7504
660fe60
chore: remove unnecessary print statements
13c7a00
docs(schema): add examples to schema functions
270732e
docs(migrating_to_5): link to migrating to 5 docs on the mongoosejs.com website
db79cfc
Merge branch 'master' of github.com:Automattic/mongoose
67754bd
style: fix lint
8e30004
Merge pull request #7530 from sarpik/master
3e44bc2
Merge branch 'master' of github.com:Automattic/mongoose
aa43200
docs: add MongooseError to API docs and add list of error names
0daf626
Merge pull request #7521 from nocksapp/master
8752502
fix anchor tag
b5f1723
chore: now working on 5.4.14
There are 18 commits in total.
See the full diff
There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.
Your Greenkeeper Bot 🌴
Branch | Build failing 🚨 |
---|---|
Dependency | atob |
Current Version | 2.1.1 |
Type | dependency |
This version is covered by your current version range and after updating it in your project the build failed.
atob is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.
There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.
Your Greenkeeper Bot 🌴
Branch | Build failing 🚨 |
---|---|
Dependency | mongodb-memory-server |
Current Version | 1.9.3 |
Type | devDependency |
This version is covered by your current version range and after updating it in your project the build failed.
mongodb-memory-server is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.
The new version differs by 2 commits.
dc57509
fix(Babel): remove NodeJS v4 support
742bead
fix: change default mongodb version to latest
(#70)
See the full diff
There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.
Your Greenkeeper Bot 🌴
Hi,
Trying to run this on Ubuntu 16.04. The following is from my docker-compose version:
docker-compose version 1.21.2, build a133471
docker-py version: 3.3.0
CPython version: 3.6.5
OpenSSL version: OpenSSL 1.0.1t 3 May 2016
and Docker:
Engine:
Version: 18.05.0-ce
API version: 1.37 (minimum version 1.12)
Go version: go1.9.5
Git commit: f150324
Built: Wed May 9 22:14:32 2018
OS/Arch: linux/amd64
Experimental: false
It seems like my DNS is configured correctly. I am able to dig a random subdomain and get my IP address back. When I go to build the image, I get the following error:
scripts_1 | [./src/libs/crypto.js] 1.59 KiB {web-discover} {sysinfo} [built] [1 error]
scripts_1 | [./src/libs/network.js] 2.41 KiB {web-discover} {sysinfo} [built]
scripts_1 | [./src/libs/session.js] 2.15 KiB {web-discover} {sysinfo} [built]
scripts_1 | [./src/payloads/sysinfo.js] 1.58 KiB {sysinfo} [built]
scripts_1 | [./src/payloads/web-discover.js] 1.12 KiB {web-discover} [built]
scripts_1 | + 13 hidden modules
scripts_1 |
scripts_1 | ERROR in ./src/libs/crypto.js
scripts_1 | Module Error (from ./node_modules/eslint-loader/index.js):
scripts_1 |
scripts_1 | /src/src/libs/crypto.js
scripts_1 | 5:3 error Trailing spaces not allowed no-trailing-spaces
scripts_1 | 8:3 error Trailing spaces not allowed no-trailing-spaces
scripts_1 | 11:3 error Trailing spaces not allowed no-trailing-spaces
scripts_1 |
scripts_1 | ✖ 3 problems (3 errors, 0 warnings)
scripts_1 | 3 errors, 0 warnings potentially fixable with the `--fix` option.
scripts_1 |
scripts_1 | @ ./src/libs/session.js 1:0-34 6:21-37 7:22-32 7:49-65 26:21-31 33:19-35
scripts_1 | @ ./src/payloads/sysinfo.js
scripts_1 | ℹ 「wdm」: Failed to compile.
Thanks
1.18.5
to 1.18.6
.This version is covered by your current version range and after updating it in your project the build failed.
nodemon is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.
The new version differs by 1 commits.
521eb1e
fix: restart on change for non-default signals (#1409) (#1430)
See the full diff
There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.
Your Greenkeeper Bot 🌴
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.