0P3N Blog Blog Post
Ready to Start Your Career?
Create Free Account
By: vinothpkumar
February 9, 2016

Same-Site Scripting: The Lesser-Known Vulnerability

By: vinothpkumar
February 9, 2016
By: vinothpkumar
February 9, 2016
Same-Site Scripting: The Lesser-Known Vulnerability - CybraryHi Readers,It's quite possible that a sub-domain has a "loop back" address, i.e. 127.0.0.1. Many security researchers and developers may not be aware of this lesser-known vulnerability.Imagine a scenario where a user has to access "subdomain.example.com". If the sub domain is configured with address 127.0.0.1 and, if the user is already running a service on their localhost (Eg. Xamp/Wamp server running), he/she will obviously be redirected to the localhost services. He/she will never be able to visit "subdomain.example.com" unless the user has stopped the services on the localhost. Run a Simple TestSimply send a ping request to the sub domain to find the IP address:

ping subdomain.example.com

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

 Many organization have the DNS misconfigured with the address 127.0.0.1 (but, we won't disclose all those websites). We will share that the famous Bug Bounty Program, HackerOne, had this issue. They were notified by a security researcher and fixed the vulnerability. Let's Fix the Issue1. Change the IP address from 127.0.0.1 to a random address.2. Simply remove the sub-domain entry if it's not needed. Regards,Vinoth kumarSecurity Researcher

Join over 2 million IT and cyber professionals advancing their careers

OR REGISTER WITH

Google

Already have an account? Sign In »

Ready to Share Your Original Content?

Build your Cybersecurity or IT Career

Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry