Full Disclosure mailing list archives
Re: strange domain name in phishing email
From: "Jianqiang Xin" <jqxin2006 () gmail com>
Date: Wed, 15 Mar 2006 22:39:10 -0600
I tried the same address using nslookup of windows and linux. The linux "nslookup" and "host" generate an error message: " ** server can't find 1406379699: NXDOMAIN". nslookup of Windows translate the number to a domain name. It seems that it works different for different operating system. Have a good day and thanks for your help. On 3/15/06, gboyce <gboyce () badbelly com> wrote:
Can you do a packet capture, and find out what the request to the server looks like? Apache 2 doesn't seem to like the decimal host definition sent by most browsers. Perhaps IE 7 converts the decimal IP back into octal before sending it to the server. On Thu, 16 Mar 2006, Alice Bryson wrote:hi there: When I use IE 6 web browser, Apache 1.3 accept this kind of request but Apache 2.0 doesn't. When I use IE 7 web browser, Apache 2.0 also accept this kind ofrequest.2006/3/15, gboyce <gboyce () badbelly com>:On Tue, 14 Mar 2006, Chris Umphress wrote:On 3/14/06, gboyce <gboyce () badbelly com> wrote:I tried this trick against my personal Apache 2 webserver, and got a400bad request as well. The apache log is showing "Client sentmalformedHost header". It looks like Apache is getting the decimal host header, and doesn't understand what to do with it. Oddly, the host mentioned in theinitiale-mail is also Apache, but it's Apache 1.3. Is your Apache on windows server 1.x or 2.x?I'll jump in and say that mine works works this way (If you want to verify, it is http://1136002182/). I am using Apache 1.3 and have several virtual hosts set up. Since Apache returns the first virtual host if it doesn't match the names of any of the other virtual hosts. That could be the determining factor for why some work and others don't.I have virtual hosts setup as well, and this behavior doesn't work forme.I tested a few different servers, and what I've found is that Apache1.3accepts hosts defined in this manner. Apache 2.0 fails with a 400error.Greg _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- Homepage:http://www.lwang.org We collect spam for research at: mailto:abryson () bytefocus com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: strange domain name in phishing email, (continued)
- Re: strange domain name in phishing email Brian Dessent (Mar 11)
- Re: strange domain name in phishing email Alice Bryson (Mar 13)
- Message not available
- Re: strange domain name in phishing email Nancy Kramer (Mar 11)
- Re: strange domain name in phishing email Brian Dessent (Mar 11)
- Re: strange domain name in phishing email Alice Bryson (Mar 13)
- Re: strange domain name in phishing email Michael Holstein (Mar 14)
- Re: strange domain name in phishing email gboyce (Mar 14)
- Re: strange domain name in phishing email Chris Umphress (Mar 14)
- Re: strange domain name in phishing email gboyce (Mar 15)
- Re: strange domain name in phishing email Alice Bryson (Mar 15)
- Re: strange domain name in phishing email gboyce (Mar 15)
- Re: strange domain name in phishing email Jianqiang Xin (Mar 15)
- Re: strange domain name in phishing email Q Beukes (Mar 15)
- Re: strange domain name in phishing email Michael Holstein (Mar 14)
- Re: strange domain name in phishing email sheeponhigh (Mar 14)
- Re: strange domain name in phishing email Dave Korn (Mar 15)
- Re: Re: strange domain name in phishing email Michael Holstein (Mar 15)