2

For those who ignore it, webhooks is a service that you configure with a web interface for sending post http requests to a configured url.
Those services are sometimes offered by public sites like rdoc.info or paypal to their users.

I tried this on one of such large website :

  • configure the webhook url tohttp://www
  • trigger an event for launching a query

I got an http response, here’s the real raw server’s response :

Connection: close
Content-length: 0
Location: https://www/
  • configure the webhook url tohttps://gst
  • disable tls verification
  • trigger an event for launching a query

The server sent the company’s 500 error page without any http headers (yes not even an http status). But this is what happen when you load https://gst.thesite.com from your web browser with an incorrect host: http header.

The company confirmed their webhook service is configured to use the private master dns server (instead of using something like8.8.8.8directly).
However, they told the names I used worked because they were resolving to public ip. The program powering the webhook service use a firewall rule which drop network packets sent to local addresses (both ipv4 and ipv6), therefore they consider this as the normal behaviour. :‑(

I recognize only being able to resolve public dns A records isn’t convincing…
As a student, I don’t have enough knowledge in it for knowing what typical private dns names / domains are used in a corporate environment yet (this can be used to know what service they’re using since there is an error message that tells if a dns domain failed to get resolved)

So I’m currently stuck at that point.

  • I already got the same kind of response when I discovered that the nul character (the real one, not the encoded one) was valid in webhooks hostnames. – user2284570 Oct 15 '15 at 19:55
  • So first things first, you should make sure that the kind of experimentation that you're looking to do is allowed by the site (e.g. they have a bug bounty programme), otherwise you're running a fine line between something that at the least would break the ToS of the site, and could (depending on the site and your country of residence) get you in legal bother... – Rоry McCune Oct 16 '15 at 8:05
  • @RоryMcCune : Of course I do it because there’s a digitally signed written consent. In the response e‑mail, they even wrote “keep hacking”. – user2284570 Oct 16 '15 at 20:51
  • @RoryMcCune : I just discovered this : their server binaries aren’t compiled with stack smashing protection. Should they worry about this ? – user2284570 Oct 17 '15 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.