Metasploit mailing list archives
Question about bailiwicked_host.rb
From: hdm at metasploit.com (H D Moore)
Date: Thu, 24 Jul 2008 21:42:14 -0500
You can't overwrite existing entries, you can however, wait until the cache entry expires then spoof it. The bailiwick_domain.rb exploit does not have this limitation. On Thursday 24 July 2008, . wrote:
I thought that long TTLs did not provide any protection against this attack as the random dns requests are not going to be cached, and if you win the XID race you can just overwrite whatever in bailiwick with regardless of whether it is cached or not. (I assume I am missing something?) Why does this exploit need to sleep until the hostname is purged out of the cache??
Current thread:
- Question about bailiwicked_host.rb . (Jul 24)
- Question about bailiwicked_host.rb H D Moore (Jul 24)
- <Possible follow-ups>
- Question about bailiwicked_host.rb H D Moore (Jul 25)