full-disclosure - Whois acting funny in FreeBSD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86u13if75j.fsf@blue.stonehenge.com>
From: merlyn at stonehenge.com (Randal L. Schwartz)
Subject: Whois acting funny in FreeBSD

>>>>> "Chris" == Chris McGinnis <chrism@...ireless.com> writes:

Chris> Today I've noticed something weird on all my FreeBSD boxes.  When I
Chris> whois domains like msn.com, microsoft.com, aol.com and others I get
Chris> stuff like:

Chris> $ whois msn.com

Chris> Whois Server Version 1.3

Chris> Domain names in the .com and .net domains can now be registered
Chris> with many different competing registrars. Go to http://www.internic.net
Chris> for detailed information.

Chris> MSN.COM.TW
Chris> MSN.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
Chris> MSN.COM

Chris> My linux boxes seem to work fine.  When I query a specific whois
Chris> server such as whois.networksolutions.com it works fine also.  Is
Chris> anyone else getting anything like this?  I'm thinking maybe the
Chris> default whois server that the whois program queries has been
Chris> compromised?  I'm not sure what the default whois server is.

This is a long-known "feature" of classic WHOIS.  What happens
is that GULLI.COM has the right to register specific hostnames into
the NIC records, and has chosen a name that also contains "MSN.COM".

I believe modern WHOIS clients reject anything that doesn't *end* with
the selected domain to prevent this.

However, here's "MICROSOFT.COM" for your enjoyment.  Heh.

    MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET
    MICROSOFT.COM.WILL.LIVE.FOREVER.BECOUSE.UNIXSUCKS.COM
    MICROSOFT.COM.WILL.CRASH.IN.6MN.ORG
    MICROSOFT.COM.WILL.BE.SLAPPED.IN.THE.FACE.BY.MY.BLUE.VEINED.SPANNER.NET
    MICROSOFT.COM.WILL.BE.BEATEN.WITH.MY.SPANNER.NET
    MICROSOFT.COM.WAREZ.AT.TOPLIST.GULLI.COM
    MICROSOFT.COM.WANADOODOO.COM
    MICROSOFT.COM.SUX.BUT.PYROFREAK.ORG.RULEZ.AND.DIOXYTECH.NET.DELETED.GANDI.NET
    MICROSOFT.COM.SMELLS.SIMPLECODES.COM
    MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.COM
    MICROSOFT.COM.RUNS.ON.AN.8088.ORG
    MICROSOFT.COM.RAWKZ.MUH.WERLD.MENTALFLOSS.CA
    MICROSOFT.COM.OHMYGODITBURNS.COM
    MICROSOFT.COM.LOVES.JU1C3.COM
    MICROSOFT.COM.LIVES.AT.SHAUNEWING.COM
    MICROSOFT.COM.IS.SOON.GOING.TO.THE.DEATHCORPORATION.COM
    MICROSOFT.COM.IS.NOT.SEXYCOOL.ORG
    MICROSOFT.COM.IS.NOT.AS.COOL.AS.SIMPLECODES.COM
    MICROSOFT.COM.IS.GOD.BECOUSE.UNIXSUCKS.COM
    MICROSOFT.COM.IS.A.STEAMING.HEAP.OF.FUCKING-BULLSHIT.NET
    MICROSOFT.COM.HAS.TEH.GAY.OMFGLOL.COM
    MICROSOFT.COM.HAS.ITS.OWN.CRACKLAB.COM
    MICROSOFT.COM.HAS.A.PRESENT.COMING.FROM.HUGHESMISSILES.COM
    MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET
    MICROSOFT.COM.CUZ.I.WANNA.BE.COOL.TOO.TRUEDESIGN.COM
    MICROSOFT.COM.CAN.SUCK.MY.SERVEREXTREME.ORG
    MICROSOFT.COM.CAN.GO.FUCK.ITSELF.AT.SECZY.COM
    MICROSOFT.COM.CAN.BLOWME.ORG
    MICROSOFT.COM.ARE.GODDAMN.PIGFUCKERS.NET
    MICROSOFT.COM.AND.MINDSUCK.BOTH.SUCK.HUGE.ONES.AT.EXEGETE.NET
    MICROSOFT.COM.AINT.WORTH.SHIT.KLUGE.ORG
    MICROSOFT.COM

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@...nehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!