f1vet / bug Goto Github PK

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "net"
    "net/http"
    "strings"
    "time"

    "github.com/tidwall/gjson"
)

func main() {

    domainapi := "https://1.1.1.1/dns-query?name=www.baidu.com"
    client2 := &http.Client{}
    req2, err := http.NewRequest("GET", domainapi, strings.NewReader(""))
    if err != nil {
        // handle error
    }

    req2.Header.Set("accept", "application/dns-json")

    resp2, err := client2.Do(req2)

    defer resp2.Body.Close()

    body2, err := ioutil.ReadAll(resp2.Body)
    if err != nil {
        // handle error
    }

    fmt.Println(string(body2))
    ipp := gjson.Get(string(body2), "Answer")
    ipp = gjson.Get(ipp.Array()[2].String(), "data")
    url := "https://" + ipp.String() + "/"
    //url := "https://www.cnblogs.com"
    hostname := "baidu.com"

    sni := false

    var serverName string
    if sni {
        serverName = hostname
    } else {
        // disable sending the ServerName by using an IP
        // see tls.Config.ServerName
        serverName = ipp.String()
    }

    client := &http.Client{
        // adapted from http.DefaultTransport
        Transport: &http.Transport{
            Proxy: http.ProxyFromEnvironment,
            DialContext: (&net.Dialer{
                Timeout:   30 * time.Second,
                KeepAlive: 30 * time.Second,
                DualStack: true,
            }).DialContext,
            ForceAttemptHTTP2:     true,
            MaxIdleConns:          100,
            IdleConnTimeout:       90 * time.Second,
            TLSHandshakeTimeout:   10 * time.Second,
            ExpectContinueTimeout: 1 * time.Second,
            TLSClientConfig: &tls.Config{
                ServerName: serverName,
                // bypass Go standard verification to use our own below (VerifyConnection)
                InsecureSkipVerify: true,
                VerifyConnection: func(cs tls.ConnectionState) error {
                    // adapted from the tls.Config.VerifyConnection example
                    // behaves just like the default verification,
                    // except for the overriden DNSName below
                    opts := x509.VerifyOptions{
                        // override the requested hostname with the server hostname
                        DNSName:       hostname,
                        Intermediates: x509.NewCertPool(),
                    }
                    for _, cert := range cs.PeerCertificates[1:] {
                        opts.Intermediates.AddCert(cert)
                    }
                    _, err := cs.PeerCertificates[0].Verify(opts)
                    return err
                },
            },
        },
    }
    resp, err := client.Post(url, "application/x-www-form-urlencoded", strings.NewReader(""))
    if err != nil {
        fmt.Println(err)
        // handle error

    }

    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)

    if err != nil {
        fmt.Println("error2")

        // handle error

    }

    fmt.Println(string(body))
    fmt.Println(ipp.String())
}

[Reference]

https://xlab.tencent.com/cn/2021/05/14/domain-borrowing/

https://attack.mitre.org/techniques/T1090/004/

[Discoverer]
[email protected]