from Hacker News

HTML over DNS: Serving Blog Content over DNS

by mijndert on 8/18/21, 7:07 AM with 71 comments

by jacobkiers on 8/19/21, 6:22 AM
Author here: I made it as a proof of concept, just because I could.
I used DoH because to the best of my knowledge it's not possible to open raw sockets from the browser. Otherwise I'd have done that.
I don't think there's any practical use. And I did not intend it to have any.
by p4bl0 on 8/19/21, 8:15 AM
Well the content is stored in a DNS Zone file but it is requested using JavaScript to an external HTTP API. I wouldn't really call that HTML over DNS but rather "DNS Zone as blog database".
Anyway, this made me think of iodine [1], an IP over DNS solution, which I still run on my main server even though it has a lot less use now than it had until a few years ago when there were a lot of open wifi with captive portals and way less 4G available.
[1] https://code.kyro.se/iodine/
by xg15 on 8/19/21, 11:46 AM
The HTML bit is fun, but the more remarkable takeaway for me is that DoH servers accept cross-origin requests from ordinary javascript. This means two things:
- A website can bring its own DoH client and bypass both the OS resolver and the browser's trusted DoH resolver for anything except the initial page request.
- Any website can now access the full DNS information of any domain: Not just A/AAAA records, but also TXT, MX, SRV etc. Record metadata such as TTLs likewise.
All of that without requiring any backend infrastructure or exotic web API. It's literally just a static HTML file and fetch().
That's a genuinely new capability that wasn't available to websites before public DoH servers became available. I'm no security expert, but this smells like it should have some implications for web security.
by ignoramous on 8/19/21, 6:02 AM
Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie replacement [2].
[0] https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca...
[1] https://github.com/Jigsaw-Code/choir (disclosure: I co-develop hard-forks of two other related Jigsaw-Code projects)
[2] http://dnscookie.com/
by 1vuio0pswjnm7 on 8/19/21, 6:04 AM
Looks more like HTML via HTTP, specifically DoH.
```
    const dohServer = "https://cloudflare-dns.com/dns-query?ct=application/dns-json&type=TXT&name=";
    const baseDomain = "hod.experiments.jacobkiers.net";
```
About 12 years ago I experimented with HTML over UDP DNS by modifying dnstxt from djbdns to output a MIME header. I could store tiny web pages, i.e., hyperlinks, in a zone file and serve them with tinydns. (This was before the size of DNS packets ballooned with adoption of EDNS.)
by ThePhysicist on 8/19/21, 8:45 AM
This technique has been a standard exfiltration & C2 (command & control) channel for malware for a long time. Typically malware will make a DNS request for a subdomain where the domain name encodes data or a request, and the response contains e.g. commands.
by geocrasher on 8/19/21, 5:51 AM
As someone who has an obsession with base64 encoding (as exemplified by my poorly written shell scripting here: https://miscdotgeek.com/curlytp-every-web-server-is-a-dead-d... ) I love this. It makes me wonder if some CSS and maybe even a highly compressed image or two could be added.
by beembuild on 8/19/21, 11:34 AM
I modified the dnstxt file from djbdns about twelve years ago to output a MIME header for HTML over UDP DNS. I could store hyperlinks for tiny web pages in a zone file and serve them with tinydns. (This was before EDNS exploded the size of DNS packets.) regards https://minimilitiamodapk.info/

by PinguTS on 8/19/21, 7:34 AM

Wondering why I can't query the DNS directly.

  $ dig posts-2021-08-17-serving-blog-content-over-dns-md.hod.experiments.jacobkiers.net TXT
  
  ; <<>> DiG 9.8.3-P1 <<>> posts-2021-08-17-serving-blog-content-over-dns-md.hod.experiments.jacobkiers.net TXT
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49067
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
  
  ;; QUESTION SECTION:
  ;posts-2021-08-17-serving-blog-content-over-dns-md.hod.experiments.jacobkiers.net. IN TXT
  
  ;; AUTHORITY SECTION:
  hod.experiments.jacobkiers.net. 292 IN SOA home.kie.rs. postmaster.kie.rs. 2021081903 3600 900 604800 3600

by masklinn on 8/19/21, 7:30 AM
> You might not be able to see it immediately
Or at all since the content is entirely injected via JS with no fallback (and the JS uses class fields in case you thought an old browser might be able to load it).
by mvolfik on 8/20/21, 12:18 PM
That's interesting. I'm thinking about ways how this could be combined with https://dnskv.com - which allows not only reading from dns, but also storing:
```
    dig TXT content.uniquekey.dnskv.com
    --> 'ok'

    dig TXT uniquekey.dnskv.com
    --> 'content'
```
Only thing that comes to my mind is data exfiltration from sites with content-security-policy which for some reason allows some DoH site
by erkkonet on 8/19/21, 11:13 AM
All sites on the .tel domain used to be rendered from DNS. It seems to have changed in 2017 but Wikipedia still says[1]:
"In contrast to other top-level domains, .tel information is stored directly within the Domain Name System (DNS) [...] as opposed to the DNS simply returning details (such as IP addresses)"
[1] https://en.wikipedia.org/wiki/.tel
by IncRnd on 8/19/21, 6:38 AM
This looks like it was a fun project!
For anyone who wants to research the subject, the class of security vulnerabilities are called DNS tunneling.
by kix53 on 8/19/21, 11:07 AM
The RR format can be made more efficient. TXT records can contain multiple character strings of up to 255 bytes, and despite their name can contain arbitrary octets. A step further from there would be to use a private use type (65280-65534) so your payload doesn't need to be cut into length byte prefixed chunks.
by mobilemidget on 8/19/21, 11:52 AM
"100s of requests per second"
dns works fine at those rates or higher, and you'll use caching dns servers of ISPs, scales like no other, geo support etc etc. I think its great idea for public data.
by redspl on 8/19/21, 1:32 PM
dig @1.1 TXT +short owo{0..201}.xn--kda.waw.pl | sed -E 's/[" ]//g' | base64 -d | mpv -
by fsiefken on 8/19/21, 9:42 AM
this would be nice for the gemini protocol or something linke twtxt as it is more text oriented, one could perhaps use base45 or other base for extra space efficiency. for the ultimate in image compression go avif or svg.
by sonicggg on 8/19/21, 5:58 AM
What's the point though? I can think maybe of reduced latency, but then you usually have the DNS already cached locally. And that takes me to a second point, won't you run into problems delivering content updates, given that clients will most likely cache DNS entries?