Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are and your victim is of course Then I've thought of 2 scenarios:
1. You somehow manage to find DNS server, poison the cache there and just wait for your victim to connect
or 2. You bombard with resolved queries from a previously setup DNS server, which queries are of course forged.

So my question is : Is scenario 2 possible in any way? Because i couldn't find a reason why it would not work, and knowing my luck there's a simple answer to that.

Here's the paper I've been reading about it : SANS

share|improve this question
To reach the external network, must you pass through the internet ? – Francois Valiquette Apr 19 '13 at 19:19
Yes, that's what i meant. – Genesis Apr 20 '13 at 15:10
up vote 0 down vote accepted

To do this you will have to spoof the IP address of the DNS server and if you must pass through the internet, the attack will probably won't work for two reasons:

  1. If the DNS server of the victim is in his intranet with a private IP number you won't be able to send the packet through the internet since private IP addresses from private ranges are not rooted over the internet.

  2. If you spoof a public IP address and you try to send it, your ISP will probably not root it and it will just drop the packet. Before rooting a packet some rooters check if it is plausible that the source IP came from a specific interface.

If you don't need to pass through the internet to reach the external network, your private router may root the packets depending of its configuration

share|improve this answer
What do you mean that my router may do the trick? Could you please explain the process? – Genesis Apr 19 '13 at 20:47
Well, let's say you have the IP and you are connected through a switch that is connected to a router port with the address Also, let's presume that your victim address is and its switch is connected to the same rooter as you but on another port which have the address Also, let's say that the DNS server is somewhere in If you spoof the DNS server address the rooter will still root the packet even if it is impossible that the rooter gets a packet from to on interface . – Francois Valiquette Apr 20 '13 at 4:20
Oh now i got it :) Thanks. – Genesis Apr 20 '13 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.