Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?

for example : IP , Port number and Transaction number what else ?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

There are a number of different possible vectors for DNS cache poisoning. Generally, it is an attack against a DNS server that clients use and the attacker is trying to target their attack, they only need to know the DNS server that the client uses. If the DNS server is resistant, another approach could be to try and actually spoof the DHCP response to get the target system to connect to the wrong DNS server. If that doesn't work, the attacker could try to compromise a DNS server that the target's DNS server might ask for help resolving a domain.

None of these require knowing the IP. The DHCP requires knowing the MAC address to target one system. I'm not sure how port number would be relevant to DNS poisoning since DNS servers operate on standard ports and the attack isn't generally against the targeted client. I'm not sure what you mean by transaction number.

share|improve this answer
    
Thanks ! much appreciate it –  Laila Gassoumi Dec 18 '12 at 18:53
add comment

The classic DNS cache poisoning attack works like this:

Someone queries a DNS resolver for example.com. The resolver will ask the authoritative server for example.com for its ip-address. This server, however, will respond with an additional DNS records for another domain. In the past many DNS resolvers cached the faked record for the other domain, too.

This attack is not related to faking DNS response packets, which is another common attack on DNS. In order to fake packets, the ip-addresses and ports of both ends need to be know or guessed by the attacker.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.