※ 引述《luckdavid (茶米)》之铭言： : 标题: [问题]资安弱扫遇到的问题Same site scripting : 时间: Wed Dec 9 13:11:37 2015 : : 各位先进大家好，我遇到一个问题解不掉想请大家帮帮忙。 : 以下是弱扫报告： : Severity：Medium : Type：Configuration : Reported by module ：Scripting (Subdomain_Takeover.script) : : Description：Tavis Ormandy reported a common DNS misconfiguration that can : result in a minor security issue with web applications. "It's a common : and sensible practice to install records of the form "localhost. : IN A 127.0.0.1" into nameserver configurations, bizarrely however, : administrators often mistakenly drop the trailing dot, introducing an : interesting variation of Cross-Site Scripting (XSS) I call Same-Site : Scripting. The missing dot indicates that the record is not fully qualified, : and thus queries of the form "localhost.example.com" are resolved. : While superficially this may appear to be harmless, it does in fact allow : an attacker to cheat the RFC2109 (HTTP State Management Mechanism) same : origin restrictions, and therefore hijack state management data." : : Impact：An attacker can cheat the RFC2109 (HTTP State Management Mechanism) : same origin restrictions, and therefore hijack state management data. : : Recommendation：It is advised that non-FQ localhost entries be removed from : nameserver configurations for domains that host websites that rely on HTTP : state management. : : 拜托了。。。 : : : -- :

※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 210.68.37.161 : ※ 文章网址: https://webptt.com/cn.aspx?n=bbs/Web_Design/M.1449637901.A.6BA.html : 推 LPH66: DNS 设定, 有一个 A 记录 localhost 应在其後加一个点 12/09 15:42 : → LPH66: 不加的话攻击者可以用 localhost.example.com 来绕过 12/09 15:43 : → LPH66: example.com 上面的 XSS 限制 12/09 15:44 : → LPH66: 或者就乾脆把这条 A 记录给拿掉, 这样 localhost 这个名字 12/09 15:47 : → LPH66: 不经过 DNS 就不会有这个问题 12/09 15:48 : → threeus: 高手在人间 12/10 18:48 请问LPH大或各位先进: 我也遇到同样的问题,本身对unix系统不太熟,依L大的留言,改了 /etc/hosts档案 把 127.0.0.1 loopback localhost 这一行加#, 如下 # 127.0.0.1 loopback localhost 但扫完的结果还是一样, 请问还有那些DNS的设定须要修改? 感谢~ --

※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 111.70.210.111 ※ 文章网址: https://webptt.com/cn.aspx?n=bbs/Web_Design/M.1469774330.A.812.html