full-disclosure - DNS mining ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <b400c69a0704090631l722b3d63he1338d24f1820283@mail.gmail.com>
Date: Mon, 9 Apr 2007 16:31:02 +0300
From: "Maxim Veksler" <hq4ever@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: DNS mining ?

Hello,

I have a domain name which has it's primary A record pointing at google.
This domain hasn't been published anywhere and is very low traffic,
surprisingly this guy has it listed as one of the entries pointing to
google:

http://72.14.205.104/search?q=cache:Vp6UWUf7NmMJ:mousecave.com/google/+rfsee.net

His list is correct, question is how could he possibly compose it?
Scanning the whole [[:alnum:]]{1,30} dns range is impractical. I find
it hard to believe he is sniffing some major backbone router for
traffic and having access to a root DNS won't help him much (IMHO).
How could he then have done it? The only option I can think of is that
he is working @google or has backdoor access to google indexing
service which allows him to query for info such as "With what header
did the http request came to the server".

I find this highly intriguing.

Ideas are welcome.

-- 
Cheers,
Maxim Veksler

"Free as in Freedom" - Do u GNU ?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/