Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
rainbow-dns
Advanced tools
:rainbow:-dns is a DNS server with an http API for populating it's records. Inspired by skydns.
npm install -g rainbow-dns
rainbow-dns
--apihost // API host (default 127.0.0.1)
--apiport // API port (default 8080)
--dnshost // DNS host (default 127.0.0.1)
--dnsport // DNS port (default 53)
--ttl // Time To Live (default 300 -> seconds)
--store // Records datastore (default mem -> memory)
--domain // Domain (default random)
--fwdhost // Forward host
--fwdport // Forward port
--static // Path to static records file
--ipv4-for-ipv6 // Broken linux NODATA response handling crutch
By passing a --fwdhost flag you can forward requests to another dns server if rainbow-dns don't have any matching records.
rainbow-dns --fwdhost 8.8.8.8
By passing a --static flag you can inject some static records from a json file.
rainbow-dns --static ./static.json --domain dance.kiwi
// Example static.json
{
"records" : [
{ "name" : "break", "A" : [{"address" : "192.168.1.100"}] }
{ "name" : "popping", "CNAME" : [{"data" : "break.dance.kiwi"}] }
]
}
Due to an issue with some recent linux distributions not properly handling (valid) NODATA responses, you can set the --ipv4-for-ipv6 flag to include A records in response to AAAA requests and thereby working around this issue.
Symptom:
curl app.domain.com
// unable to resolve hostname
curl app.domain.com -4
// 200 OK
GET /
List all records
PUT /{name}
Add record name.domain
DELETE /{name}
Delete record name.domain
// Valid json payload
{
"A" : [{"address" : "192.168.1.1"},{"address" : "192.168.10.1"}],
"AAAA" : [{"address" : "2605:f8b0:4006:802:0:0:0:1010"}]
}
Rainbow-dns supports all record types listed here provided that you include the required properties, with appropriate key and value, for the respective record type. Rainbow-dns will not validate your input and will only eject an error message upon requests if your record data is invalid.
The payload for a CNAME record would look something like this:
{
"CNAME" : [{"data" : "elsewhere.domain.com"}]
}
Defaults (domain, ttl) can be included in the payload and thereby overwritten by PUTs.
curl -X PUT localhost:8080/database -d '{"A": [{"address" : "192.168.1.10"}], "ttl" : 999}' -H 'Content-Type: application/json'
dig @localhost database.polychromatic.mo +short
// 192.168.1.10
dig @localhost polychromatic.mo
// polychromatic.mo. 5 IN A 192.168.1.10
dig @localhost "*.polychromatic.mo"
// database.polychromatic.mo. 5 IN A 192.168.1.10
rainbow-dns
's matching is now case insensitive :point_right: rfc 4343. Thanks to @valentin2105 for catching this one! :rainbow: :tada:FAQs
DNS server with http API
The npm package rainbow-dns receives a total of 5 weekly downloads. As such, rainbow-dns popularity was classified as not popular.
We found that rainbow-dns demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.