Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

failed to resolve hostname problem #460

Closed
digininja opened this issue Mar 21, 2017 · 19 comments
Closed

failed to resolve hostname problem #460

digininja opened this issue Mar 21, 2017 · 19 comments

Comments

@digininja
Copy link
Contributor

I've had this a couple of times now:

+ OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request over HTTP/1.0. The value is "10.22.5.246".
+ ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't resolve hostname
+ Scan terminated:  20 error(s) and 6 item(s) reported on remote host
+ End Time:           2017-03-21 11:08:13 (GMT0) (6 seconds)

The hostname is hardcoded in the hosts file and can be resolved through DNS. From memory, the last time this happened there was also an internal IP disclosure so I'm wondering if that check is somehow overwriting the hostname variable and so breaking everything.
@ss23
Copy link
Contributor

ss23 commented Mar 22, 2017

I'm also recieving this error, though there is nothing related to an internal IP address.
Here is an excerpt as it looks slightly different for me (have removed some information):

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:
+ Start Time:         2017-03-22 16:12:22 (GMT13)
---------------------------------------------------------------------------
+ Server: nginx
+ Retrieved x-powered-by header: web2py
+ Uncommon header 'web2py_error' found, with contents: invalid path
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack.
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't resolve hostname
+ Scan terminated:  20 error(s) and 24 item(s) reported on remote host
+ End Time:           2017-03-22 16:12:30 (GMT13) (8 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

@ss23
Copy link
Contributor

ss23 commented Mar 22, 2017

git bisect indicates that 1525fdd is the commit causing this on my end, though I have no idea how this is possible...

@tautology0
Copy link
Collaborator

That commit causing the problem does indeed make no sense. Any chance of the results of a -D d for the affect call so we can see what the address is being overwritten by? (or even the results of a -Save.)

The fact you're getting multiple HSTS messages tells me that the hostname keeps on getting changed with each request.

@ss23
Copy link
Contributor

ss23 commented Mar 22, 2017

I can see that the hostname has changed from "x.com', to "admin.x.com', which is an internal only domain. I'm going to continue investigating though.

@digininja
Copy link
Contributor Author

Looks like it is doing subdomain enumeration at the end of the scan, I may have missed it but I don't remember Nikto doing that before.

This is the debug from my run.

nikto_debug.txt

@tautology0
Copy link
Collaborator

tautology0 commented Mar 22, 2017 •
edited
Loading

Ah that would make total sense. One of the lines removed was to ensure that the mutate plugins, including subdomain enumeration would not be run, which means that subdomain is being run (and it's obviously not working that well).

A quick solution would be to put these two lines back into nikto.conf:

@@Mutate=dictionary;subdomain
@@default=@@ALL;-@@Mutate;tests(report:500)

@tautology0
Copy link
Collaborator

I'll try and patch it properly, but I'm onsite at the moment with poor Internet access, so I may have to leave this 'til next week.

@digininja
Copy link
Contributor Author

That fixed it, thanks.

@sullo
Copy link
Owner

sullo commented Mar 23, 2017

Hmm, seemed like a good idea at the time--crap.

So we should have:
@@DEFAULT=@@ALL;-subdomain;-dictionary;tests(report:500)

Correct, @tautology0 ?

@digininja
Copy link
Contributor Author

digininja commented Mar 23, 2017 via email

@tautology0
Copy link
Collaborator

There's two problems here:

  1. The definition for which plugins are meant to be run was broken by the patch to remove MUTATE. This can be easily fixed with something like (where @@extra should contain the names of any plugins that we don't want to be run by default)

@@extra=subdomain;dictionary
@@default=@@ALL;-@@extra;tests(report:500)

  1. The subdomain plugin is broken. I favour removing this one totally as there're much better programs to do this around.

The reason why we haven't had a problem with the dictionary plugin is that it has a required parameter or it doesn't do anything, whereas subdomain will do things.

@digininja
Copy link
Contributor Author

digininja commented Mar 23, 2017 via email

@tautology0
Copy link
Collaborator

Fixed as discussed above. Also removed subdomain plugin (may I could've deprecated it, but I don't think any one actually uses it).

Moved a few plugins into the EXTRAS list which may improve running time in some cases.

@sullo
Copy link
Owner

sullo commented Mar 25, 2017

@opt9 has been adding to the subdomain DB,so someone uses it at least.

I'd generally prefer to keep big changes like this for a full release like 2.2, but it doesn't seem like that's going to happen for another 5 years! :) Someone needs to get motivated around here and finish that up (/me looks in mirror).

Thanks @tautology0

@digininja
Copy link
Contributor Author

digininja commented Mar 25, 2017 via email

@tautology0
Copy link
Collaborator

@digininja you could persuade him to give a talk at Steelcon. If not, I'll take beer on his behalf...

@digininja
Copy link
Contributor Author

digininja commented Mar 26, 2017 via email

@sullo
Copy link
Owner

sullo commented Mar 27, 2017

@digininja come on over to rvasec--beer on me!

@digininja
Copy link
Contributor Author

digininja commented Mar 27, 2017 via email

@digininja digininja mentioned this issue Jun 13, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@digininja @ss23 @sullo @tautology0