Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I guess this is not considered a true MITM attack since the attacker does not have to be between the server and client. My question is how it is possible to poison a DNS cache, and redirect traffic to your computer that is hosting a proxy that then forwards traffic to the actual web server? I wanted to simulate an such an attack by setting up BIND on my network but I'm not sure how to configure a proxy like paros to forward traffic to a specific web server. For example, I will run Apache on 192.168.1.2 which will host www.example.com on my LAN, BIND on 192.168.1.2, and Paros on 192.168.1.3. I will then use Kaminsky's improved birthday attack to poison the cache of the bind server which will redirect all queries of www.example.com (192.168.1.2) to 192.168.1.3 which runs Paros. I can do everything up to this point, but I don't know how to properly configure Paros to then forward traffic to the actual web server @ 192.168.1.2 whenever www.example.com is queried by another host on my network.

share|improve this question

1 Answer

up vote 0 down vote accepted

This is not exactly what you were asking for, and I'm not sure if it's close enough...
But you can look up DNS Rebinding, which effectively does something very similiar (perhaps a bit in reverse), in a very simple way.

From the linked wikipedia article:

The attacker registers a domain (such as attacker.com) and delegates it to a DNS server he controls. The server is configured to respond with a very short time to live (TTL) record, preventing the response from being cached. When the victim browses to the malicious domain, the attacker's DNS server first responds with the IP address of a server hosting the malicious client-side code. For instance, he could point the victim's browser to a web site that contains malicious JavaScript or Flash.

The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the internet.

Specifically to what you were asking, if a DNS server or client is not configured correctly, they may accept DNS responses, even if they did not originally send that request. In that case, it would be possible to send an arbitrary DNS record, that will be cached and saved by the DNS server.
I do not know how common this is anymore, as I'm pretty sure most common DNS packages prevent this by default.

share|improve this answer
Thanks for the response. To answer your question, yes I do see alot of DNS servers vulnerable to ISC Bind 9 Cache Poisoning nowadays, althought that it decreasing due to DNSSEC. What you seem to be describing is the exploitation process which I have been able to do; I am asking about post-exploitation, specifically if a malicious DNS record that points to an IP controlled by the attacker were to be cached, how would that attacker configure a proxy on that IP that forwards the traffic to the correct IP for the poisoned domain? – Bhubhu Hbuhdbus Mar 22 '12 at 10:19
@BhubhuHbuhdbus I'm not sure I understand what you're asking - you've already captured the traffic, now you want to forward this to the real server? That seems to me to be kinda trivial... you can do that applicatively, or you can simply forward the request to the real IP. It may be necessary to add in the Host: header, for webservers hosting several domains on virtual hosts. – AviD♦ Mar 22 '12 at 10:46
Just re-read your q, and I think you're simply asking how to configure the proxy to forward requests? I haven't used Paros in quite some time (I find it inferior), but e.g. Fiddler has a very straightforward dialog for that. If you're using a standard proxy, e.g. Apache, well then you should be asking in Server Fault :) – AviD♦ Mar 22 '12 at 10:48
OK so I can use Fiddler to forward the requests that have been sent to my IP for www.example.com (hosted using Apache) to www.example.com's real IP? – Bhubhu Hbuhdbus Mar 22 '12 at 10:50
And to answer your question the point of forwarding the traffic is to make the attack stealthier than say a phishing page. By poisoning the DNS cache, routing traffic for www.example.com to a proxy on an IP controlled by the attacker, and then rerouting the traffic to the actual web server (in this case Apache) the attacker could avoid detection more easily than if he made a phishing page which would be picked up on quite quickly. – Bhubhu Hbuhdbus Mar 22 '12 at 11:14
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.