News for hackers. Stuff that matters.

A comment on TXT Record XSS. Parent comment

Re:TXT Record XSS by venaoy on Thursday September 18, 2014 @07:17PM (#8338201)
You are incorrect. An HTTP GET still requires a 3-way TCP handshake, so your suggestion requires 5 steps not 2:

  1. TCP SYN to port 80
  2. TCP SYN/ACK
  3. TCP ACK
  4. HTTP GET
  5. HTTP reply with HTML content
[ Parent | on HN ]
Re:TXT Record XSS by dschatz on Thursday September 18, 2014 @08:15PM (#8338392)
FYI both a TCP SYN and SYN/ACK can carry a payload (which could be the GET and RESPONSE)
[ Parent | on HN ]
Re:TXT Record XSS by caf on Friday September 19, 2014 @01:01AM (#8339069)
The SYN packet can contain data, but the spec requires that it not be passed down to the application until the three-way handshake is complete (so a SYN-with-data from a spoofed source address won't elicit a response).

The TCP Fast Open proposal gets around this by using a cookie, so that the first connection requires a normal three-way-handshake, but subsequent connections between the same client and host can use an expedited handshake that eliminates a round trip.

[ Parent | on HN ]
Re:TXT Record XSS by cgjaro on Thursday September 18, 2014 @10:55PM (#8338785)
Yeah but in practice no browser does this. There is no system call on Linux or Windows to push data as part of the SYN packet. You would have to craft TCP/IP packets and their headers with a raw socket...
[ Parent | on HN ]
Re:TXT Record XSS by caf on Friday September 19, 2014 @01:05AM (#8339074)
Linux does support this for "TCP Fast Open" - the system call used is sendto() or sendmsg() with the MSG_FASTOPEN flag set, in place of the usual connect().
[ Parent | on HN ]
Re:TXT Record XSS by opejn on Thursday September 18, 2014 @11:30PM (#8338869)
Even if you did do this, any server implementing SYN cookies would ignore the payload and require you to retransmit anyway.
[ Parent | on HN ]
Re:TXT Record XSS by wiml on Friday September 19, 2014 @12:58AM (#8339065)
IIRC, both the Linux and BSD socket implementations let you do this with a combination of a few sockopts.
[ Parent | on HN ]