THREAT OPS › Threat News › Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname as an argument. Last week, I wrote about scans for the cloud metadata service listening at 169.254.169.254. These scans attempted to exploit Server Side Request Forgery (SSRF) vulnerability. One way to prevent these types of exploits is to filter requests that
MITRE ATT&CK techniques
- IP AddressesT1590.005
Original source: https://isc.sans.edu/diary/rss/33280