0

I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com.

Given the understanding of how DNS works I have, to work around the problem, I user an online DNS lookup tool (dnsqueries.com). From an A record I found the IP address 192.230.70.134. I happily entered that into the browser, trying both :80 and :443, but got returned the following error:

192.230.70.134 - Resolving failed

Error code 22

The proxy failed to resolve site from host name, if this site was recently added please allow a few minutes before trying again.

<...> Proxy IP 192.230.70.134

When using :443, Chrome also shows that the website's HTTPS Certificate is invalid, even though when inspecting it, it looks alright and it even says Certificate is OK.

I don't understand what sort of DNS resolution it is complaining about and why I could be facing such a problem.

|improve this question
  • 1
    It doesn't necessarily mean a DNS resolution error. It may be that the target server hosts multiple sites, and uses the domain name supplied by the client to determine which one you want to access. If there isn't a domain name supplied, it doesn't know which site you're after. This is suggested by the proxy part of the error. – Matthew Oct 24 '18 at 14:33
  • Interesting. Could you please elaborate on that? Does that mean that when you send an HTTP request, after the DNS resolution, you are still sending the domain name in the request (in some sense) and the server can make choices depending on which domain you are using? What protocol layer is that in? E.g. I have no idea how to send a request (using Postman or something alike) providing an IP address to avoid DNS resolution, but also Domain Name (for the proxy)? – eddyP23 Oct 24 '18 at 14:39
  • 1
    It's name based virtual hosting (en.wikipedia.org/wiki/Virtual_hosting#Name-based). The easiest way to access a site using it where you can't resolve DNS in the usual way is to add it to your hosts file (process varies based on OS), thereby bypassing any external lookup for DNS. – Matthew Oct 24 '18 at 14:43
3

HTTP and HTTPS are protocols which need the correct hostname in most cases. Often multiple sites are hosted on the same IP address and they can be distinguished only by the name given either in the HTTP-Host header and in case of HTTPS the SNI extension in the TLS handshake. Accessing a site by IP address omits the information about the requested hostname and thus can result in strange error messages or the wrong certificates.

In the specific case of pinnacle.com and the IP address 192.230.70.134: this IP address belongs to Incapsula which is a DDoS mitigation company. The error message you see is from their reverse proxy which forwards the traffic to the protected sites. It cannot handle the hostname 192.230.70.134 given in the HTTP requests since it expects instead the real hostname pinnacle.com. That's what the error message "failed to resolve site from host name" means - it is about finding the target host to the given name and not about DNS resolution.

|improve this answer
  • Would it work to change the Host header to the correct domain name while still trying to connect to the IP address? So 192.230.70.134 and then change the host header from 192.230.70.134 to pinnacle.com. Could be done with a intercepting proxy like Burp. Am I understanding this wrong? – Wealot Oct 25 '18 at 14:05
  • 1
    @Wealot: yes, this would work. Just compare the output of curl -v http://192.230.70.134 with curl -v -H 'Host: pinnacle.com' http://192.230.70.134. But as you can see from the second request: it will redirect to www.pinnacle.com which is the same IP address but a different hostname. This means it is not sufficient to set a fixed hostname, it must instead match the actual request. – Steffen Ullrich Oct 25 '18 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.