subidx

vee1e/subidx

Fork 0

mirror of https://github.com/vee1e/subidx.git synced 2026-09-01 17:57:13 +00:00

Commit graph

Author	SHA1	Message	Date
lakshit verma	9a232a950c	server: reject unexpected Host headers to block DNS rebinding The API accepted any Host header, so a page running a DNS rebinding attack could point attacker.com at 127.0.0.1 and read the collected index from the victim's browser as same-origin JavaScript. Requests whose Host is not localhost/127.0.0.1/::1 now get 421; -allowed-hosts extends the list for exposed deployments. Rate limiting keyed on the victim's own IP provided no protection here.	2026-08-22 03:44:43 +05:30
lakshit verma	9374d0a191	subidx: CT log tailer and crt.name-compatible subdomain search API	2026-08-21 14:26:32 +05:30

Author

SHA1

Message

Date

lakshit verma

9a232a950c

server: reject unexpected Host headers to block DNS rebinding

The API accepted any Host header, so a page running a DNS rebinding
attack could point attacker.com at 127.0.0.1 and read the collected
index from the victim's browser as same-origin JavaScript. Requests
whose Host is not localhost/127.0.0.1/::1 now get 421; -allowed-hosts
extends the list for exposed deployments. Rate limiting keyed on the
victim's own IP provided no protection here.

2026-08-22 03:44:43 +05:30

lakshit verma

9374d0a191

subidx: CT log tailer and crt.name-compatible subdomain search API

2026-08-21 14:26:32 +05:30

2 commits