Re: Bind_query

["George A. Theall" <theall@tenablesecurity.com>]

On Tue, Dec 19, 2006 at 03:58:36PM -0600, Scott Pate wrote:

> Plugin 10539 reported a DNS server as allowing recursive queries.  I
> tried to verify this with:
...
> if ( (pk["flags"] & 0x8085) == 0x8080 )
>  security_warning(port:53, proto:"udp"); 
...
> It looks like nessus is relying on the 'ra' bit to determine if
> recursion is available...correct?
Yes.

> If this is the case, why does it report this since the response (from
> below) is 0x8082?
Look at the code - 0x8082 & 0x8085 == 0x8080, right? So where's 0x8085 
come from? Well, 0x8000 indicates the message is a response and 0x0080 
indicates recursion is available.
> Also, when the script builds the query, it apparently sets the DNS flags
> to "dns["flags"] = 0x0100;", but from the packet capture you see that
> the query is actually 0x0000.  Is this correct?
No, it's a bug. Thanks for pointing it out. I've just fixed it.

George
--
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus