Re: DNS Misconfiguration on- http://cyberia.net.sa/
On 05 Jun 2020, at 04:10, Jukka Pakkanen wrote: > Thx for the info, had missed this one and actually we have that minor > misconfiguration too. Have had since 1995 when started our nameservers and > never noticed… If it makes you feel better, it wasn't an error in 1995. I remember removing the last of the localhost pointers in my dns setup less than 20 years ago. Perhaps a lot less? More than 8 years ago for sure. I do not remember why it was recommended in the first place for sure, but I think it was to reduce load on the DNS, nor why it stopped being recommended, probably some attack vector? -- Do not meddle in the affairs of Dragons for you are crunchy and taste good with ketchup ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
Re: DNS Misconfiguration on- http://cyberia.net.sa/
Wholeheartedly agreed. Not to mention that it's extremely rude to demand fame/money like that. These are not security researchers, they're skids. (Please disregard the previous email, pressed the wrong reply button and realized it too late..) On 6/5/20 11:53 AM, Ondřej Surý wrote: The localhost. is not scam, but the „I found this on HackerOne and I now want money“ is scam. Remove the localhost entry from the zone, but you should not pay money for issues that can be produced by automated scanners. HackerOne is doing everyone disfavor by paying nonsensical amounts of money[*] for small issues like this. They (and other wealthy companies) should be paying money only for original security research and not this nonsense. * $100 is a helluva money in some economies... Ondrej -- Ondřej Surý ond...@isc.org -- Met vriendelijke groet / Best regards, Michael De Roover ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
Re: DNS Misconfiguration on- http://cyberia.net.sa/
The localhost. is not scam, but the „I found this on HackerOne and I now want money“ is scam. Remove the localhost entry from the zone, but you should not pay money for issues that can be produced by automated scanners. HackerOne is doing everyone disfavor by paying nonsensical amounts of money[*] for small issues like this. They (and other wealthy companies) should be paying money only for original security research and not this nonsense. * $100 is a helluva money in some economies... Ondrej -- Ondřej Surý ond...@isc.org > On 5 Jun 2020, at 11:24, Jukka Pakkanen wrote: > > Complete scam, ignore. > > Just check the “securityfocus” link, it’s fake too. > > Jukka > > Lähettäjä: bind-users Puolesta Ejaz Ahmed > Lähetetty: 5. kesäkuuta 2020 10:55 > Vastaanottaja: bind-users@lists.isc.org > Aihe: Fwd: DNS Misconfiguration on- http://cyberia.net.sa/ > > > > > Some one is is claiming that our name server 212.118.64.2 is vulnerable with > below information is this true > > Any suggestions would be appreciated > > Thanks a n advance > > Ejaz > > > > > Dear CYBERIA GROUP Security Team , > > I Rahul a Ethical Hacker and Security Researcher. I found a vulnerability on > your website that is DNS Misconfiguration . > > Your localhost.cyberia.net.sa has address 127.0.0.1 and this may lead to > "Same- Site" Scripting. I can also ping the localhost network. > > > Here is detailed description of this minor security issue : > http://www.securityfocus.com/archive/1/486606/30/0/threaded > > Find attached POC Video. > > Dear Team Waiting for your response and I want bounty(money) with an > Appreciation letter for my work and effort which I have given for > > > Thanks in advance > Ejaz > > > > > ___ > Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe > from this list > > ISC funds the development of this software with paid support subscriptions. > Contact us at https://www.isc.org/contact/ for more information. > > > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users signature.asc Description: Message signed with OpenPGP ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
