3

Lets assume you have these DNS-entries for domain.tld:

host = domain.tld  
type = SOA  
mname = dns.otherdomain.tld  
rname = hostmaster.otherdomain.tld  

host = domain.tld  
type = NS
target = ns1.thirddomain.tld

host = domain.tld  
type = NS
target = ns2.thirddomain.tld

Note: For domain.tld there is no A-record, no AAAA-record and no CNAME-record, only the three records shown above.

This one is for www.domain.tld:

host = www.domain.tld  
type = CNAME
target = site.otherdomain.tld  

And there also is this one for site.otherdomain.tld:

host = site.otherdomain.tld  
type = A
ip = 192.168.123.234

Is it possible, that this combination is vulnerable? I ask, because there are browsers (like firefox) that behave different than other browsers:

When you use Google Chrome to call http://domain.tld/ you get a message that says, that the browser can't open this site.

But when you open the same URL in Firefox, the content of 192.168.123.234 will be displayed. This is because Firefox tries to open http://www.domain.tld/ when it fails to open http://domain.tld/

Is this combination of DNS-entries safe?

btw: I found such a constellation in the wild. I have no idea, why it was made this way. I just wonder if such a constellation can rise any security risks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.