full-disclosure - Using domain whois information for fun and profit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon Feb 27 21:02:19 2006
From: very at unprivate.com (php0t)
Subject: Using domain whois information for fun and
	profit

 > A google search for HTML based Whois pages turned up:
http://networking.ringofsaturn.com/Tools/whois.php
 >  If you do a whois on carefreetravelmn.com
<http://carefreetravelmn.com/> , you get a popup window. 

 >  Should internic allow <tags> to be used in domain registration
contact info? 

  I don't see why not, it's just data. It comes without saying that if
you use data in a context where it might be more, you handle it
appropriately. If you echo data that is interpreted by a browser, you
should filter the tags - be it user input, the http referer field, the
reverse dns for the IP, etc.
  Plus, when i do a whois at the shell, i wouldn't like to see &lt/&gt
instead of the the html opening tags. The idea ain't bad though, it's
probably fun to see info about some percentage of the people that do
whois on our domains/ip's.

php0t

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060227/1bd3d001/attachment.html