full-disclosure - Using domain whois information for fun and profit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <daeeb7f30602271413mf673349w92e9df9a6c35f781@mail.gmail.com>
Date: Mon Feb 27 22:13:13 2006
From: lolirt at gmail.com (Response Team)
Subject: Using domain whois information for fun and
	profit

You do realize that Windows, the OS that runs most of the computers on
Earth, does not have a native whois tool.

Anyway...

As someone else pointed out, this has already been reported but apparently I
missed it.

The evil side of <script> in Whois info:

It still is an interesting way to get traffic to your site, or to do a
phishing scheme.

For example, you could target customers of a particular registrar by linking
to whois.php?query=malicious_domain_whois.com on their server. Use the
<script> tag to open a popup requesting the user to update their domain
registration information. The parent URL in their browser is correct and
they are at a site they have done business with in the past.

Every "average Joe" user with a blog wants their own domain name. Being
threatened by email to update their contact information or lose the domain
is enough to get many of them to click. Also, if people will fill in their
paypal information on www.hacked-website/vulnerable/guestbook/www.paypal-
verify.com/thieves.php, why wouldn't they fill it in on a site they trust?

Getting the registrar's client list would take some time, but using a botnet
to do distributed whois gathering would give you all of the information you
need. A whois record usually shows who the registrar is and the owner
contact information. Sending a spoofed email out domain owner addresses of
people who have registered domains under a specific registrar would be
trivial.

Anyway, just a thought.

-traid

On 2/27/06, Joachim Schipper <j.schipper@...h.uu.nl> wrote:
>
> On Mon, Feb 27, 2006 at 02:41:17PM -0600, Response Team wrote:
> > The whois information for this domain contains a <script> tag. This
> means if
> > you are to view the whois information on any HTML based page, the script
> is
> > executed.
> >
> > Registrant:
> >    DOMIBOT (CAREFREETRAVELMN-COM-DOM)
> >    Avenida Caroni 5478
> >    Colinas Monte, Caracas
> >    Venezuela
> >    +1.2085751538
> >    <script>open('http://CAREFREETRAVELMN.COM');</script>
> >    +1.2085751538
> >    domains@...ibot.com
> >
> >    Domain Name: CAREFREETRAVELMN.COM
> >    Status: PROTECTED
> >
> > A google search for HTML based Whois pages turned up: http://
> > networking.ringofsaturn.com/Tools/whois.php
> > If you do a whois on carefreetravelmn.com, you get a popup window.
> >
> > Should internic allow <tags> to be used in domain registration contact
> info?
>
> Why not? It's not like it's internic's problem that some
> people/programmers do stupid things.
>
> Blacklists wouldn't work anyway, and it's, again, not internic's fault
> or problem.
>
> And there is no reason to use a web-based client when all serious
> networking operating systems come with a whois client supplied (or at
> least very, very easily installed).
>
>                 Joachim
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060227/a68cc94f/attachment.html