Other nomination

Common localhost dns misconfiguration can lead to "same site" scripting

Tavis Ormandy

Dropping the trailing dot from a 'localhost IN A 127.0.0.1' zone record makes localhost.example.com resolve to loopback, so anything listening on a shared machine receives that domain's cookies. Ormandy names it Same-Site Scripting, gives a CUPS javascript: job_printer_uri click-exploit, and lists microsoft.com, ebay.com, yahoo.com and fbi.gov as affected.

Record

Researcher

Tavis Ormandy

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• dns
• cookie
• xss
• same-origin-policy
• info-leak
• mitigation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Tavis Ormandy, first published at the original source. Preserved copies are kept so the citation survives its host.