bugtraq - Re: Administrivia: Real domain names in PoC/exploit examples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 May 2010 08:38:57 -0700 (PDT)
From: Nate Eldredge <nate@...tsmathematics.com>
To: dm@...urityfocus.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Administrivia: Real domain names in PoC/exploit examples

On Fri, 28 May 2010, dm@...urityfocus.com wrote:

> And this is the sort of thing that would be appropriate:
> - www.example.com (this is really the best way to go)

Except that www.example.com, while reserved according to RFC 2606, 
actually resolves to a host with a web server (running, interestingly, 
Apache 2.2.3 from circa 2006), which gives you a page telling you about 
RFC 2606.  It appears to be run by the IANA.  So it might be polite not to 
use this, so as not to attack the IANA by mistake.

Better would be the reserved TLDs from RFC 2606, which AFAIK should never 
resolve at all: *.test, *.example, and *.invalid.  Unfortunately, 
"www.foo.example" is less obviously a host name compared to "www.example.com".

> - Some other place-holder that is not a valid domain such as <victim>,
> etc.

That works too.

-- 

Nate Eldredge
nate@...tsmathematics.com