mandatoryprogrammer / mandatoryprogrammer/TLD-Health-Report
False positives on the "Guatemala SOA MNAME" issue
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 18
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
In [your paper](https://thehackerblog.com/hacking-guatemalas-dns-spying-on-active-directory-users-by-exploiting-a-tld-misconfiguration/) you claim that this health report could be used to find TLDs with a vulnerability similar to the .gt one. Actually, there are several false positives because you just test if the MNAME in the SOA exists or not. You should also check if the SLD exists or not (if it exists, you cannot hijack it). Example: .fr is in the list. It is true the MNAME does not resolve but, because it is in an existing SLD, the attack is not possible.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the health-report check that tests whether the SOA MNAME resolves, then reproduce the reported .fr result and compare it with .gt. Done means an existing SLD such as .fr is not reported as vulnerable, while the genuinely exploitable .gt case remains detectable.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100