Anyway...
As someone else pointed out, this has already been reported but apparently I missed it.
The evil side of <script> in Whois info:
It still is an interesting way to get traffic to your site, or to do a phishing scheme.
For example, you could target customers of a particular registrar by linking to whois.php?query=malicious_domain_whois.com on their server. Use the <script> tag to open a popup requesting the user to update their domain registration information. The parent URL in their browser is correct and they are at a site they have done business with in the past.
Every "average Joe" user with a blog wants their own domain name. Being threatened by email to update their contact information or lose the domain is enough to get many of them to click. Also, if people will fill in their paypal information on www.hacked-website/vulnerable/guestbook/www.paypal-verify.com/thieves.php, why wouldn't they fill it in on a site they trust?
Getting the registrar's client list would take some time, but using a botnet to do distributed whois gathering would give you all of the information you need. A whois record usually shows who the registrar is and the owner contact information. Sending a spoofed email out domain owner addresses of people who have registered domains under a specific registrar would be trivial.
Anyway, just a thought.
-traid
On 2/27/06, Joachim Schipper <[EMAIL PROTECTED]> wrote:
On Mon, Feb 27, 2006 at 02:41:17PM -0600, Response Team wrote:
> The whois information for this domain contains a <script> tag. This means if
> you are to view the whois information on any HTML based page, the script is
> executed.
>
> Registrant:
> DOMIBOT (CAREFREETRAVELMN-COM-DOM)
> Avenida Caroni 5478
> Colinas Monte, Caracas
> Venezuela
> +1.2085751538
> <script>open('http://CAREFREETRAVELMN.COM');</script>
> +1.2085751538
> [EMAIL PROTECTED]
>
> Domain Name: CAREFREETRAVELMN.COM
> Status: PROTECTED
>
> A google search for HTML based Whois pages turned up: http://
> networking.ringofsaturn.com/Tools/whois.php
> If you do a whois on carefreetravelmn.com, you get a popup window.
>
> Should internic allow <tags> to be used in domain registration contact info?
Why not? It's not like it's internic's problem that some
people/programmers do stupid things.
Blacklists wouldn't work anyway, and it's, again, not internic's fault
or problem.
And there is no reason to use a web-based client when all serious
networking operating systems come with a whois client supplied (or at
least very, very easily installed).
Joachim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
