search

iclab / centinel

http://iclab.org/
MIT License
34 stars 17 forks source link

DNS primitive false positive #244

Closed lianke123321 closed 8 years ago

lianke123321 commented 8 years ago

DNS primitive has a serious bug that could cause reply for another domain name being accepted by the wrong thread.

rpanah commented 8 years ago

We should try matching the query part of the response with the actual query domain name. To clean up the data that we already have, we can use the pcaps to match the query section.

lianke123321 commented 8 years ago

False positive is still happening. Reopen the issue.

lianke123321 commented 8 years ago

Confirm fixed by #246