The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

0
votes
1answer
16 views

What should I set the TTL for my DNS to?

I've heard before that one should set TTL for the domains of recovery emails to as high value as possible. The threat model here is that an attacker uses social engineering tactics to gain access to ...
1
vote
1answer
30 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
2
votes
0answers
33 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
0
votes
0answers
22 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
1
vote
1answer
36 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
33
votes
4answers
3k views

How can changing your DNS protect your online privacy?

Looking at a Unblock-US Features (a DNS provider) on their website it states the following: Stay out of the radar of prying eyes. With Unblock-us, you’ll have peace of mind knowing that your ...
2
votes
0answers
18 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
2
votes
1answer
39 views

Can I use a domain name instead of an IP for msf persistence?

After getting a shell (meterpreter) on the victim, the first thing to do is to migrate and get the system, and then you would install a persistence to connect back to you. But the problem is the ...
3
votes
1answer
91 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
2
votes
0answers
42 views

bind9 resolves all queries to one address - a compromised server?

Since this morning we tried to open some SSL sites and were greeted by browser warnings, that certificate is not for this site. Upon checking the certificate, we determined that it is issued to ...
1
vote
2answers
66 views

How do web hosts know you own your domain?

Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend: Second, we add some ...
4
votes
1answer
84 views

How does the “Privacy Protection” option from domain names registrars work?

Some domain names registrars are offering a "Privacy Protection" option to hide your registrant details. Your whois infos will then refer to the "privacy company" providing this service instead of the ...
2
votes
1answer
111 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
1
vote
3answers
33 views

In using a VPN service is it possible to transmit data without giving away system configuration details?

In using a VPN service I want to feel comfortable in the knowledge that outsiders cant simply build up metadata on my browsing activities. The fact it is done is somewhat unsettling. I have spent days ...
0
votes
1answer
41 views

DNS in DMZ or not and mail server architecture

I'm a new user in security.stackexchange.com, I'm a French junior admin sys, I enjoyed to come here! Spend the presentation. I wonder what server I put in DMZ zone, I know the DMZ zone is for all ...
0
votes
2answers
50 views

Can we prevent DNS-based attacks with SSL/TLS? [duplicate]

Consider the following scenario giving a hypothetical attack: Crypto.com is selling cryptostocks and accepts payments using a payment processor PayEasy.com. The entire site pages (of crypto.com) are ...
1
vote
1answer
63 views

AirVPN, DNS Leaks on Windows 8.1, but not Ubuntu

I've noticed when I visit dnsleaktest.com using Windows 8.1 & Chrome a bunch of UK IP addresses (Belonging to my ISP) are displayed alongside the Netherlands IP address I should be appearing as ...
0
votes
1answer
42 views

Why include DNS client cookie in DNS server cookie computation?

The proposed standard for DNS cookies specifies that the server cookie is to be computed as follows: The Server Cookie SHOULD consist of or include a 64-bit or larger pseudo-random function ...
2
votes
1answer
36 views

Detect host lookups against a domain/subdomain name

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. ...
12
votes
2answers
210 views

How was The Pirate Bay datacenter kept hidden?

How were The Pirate Bay's servers kept hidden for so long? You would think that it would be easy finding the servers that so many DNS servers are pointing to. Tracing the chain to the main datacenter ...
2
votes
2answers
61 views

Is VPN the only way to stop my ISP from logging my traffic?

I do know that my ISP is keeping logs permanently, which I'm not comfortable with because I like my privacy. Having said that, is VPN the only option to prevent my ISP from logging my traffic? The ...
4
votes
1answer
56 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
0
votes
1answer
44 views

Why is a DNS Amplification attack considered a DDoS attack?

My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victims. The DNS responds to this IP address with a ...
0
votes
0answers
62 views

Script to emulate dns for windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...
1
vote
1answer
28 views

Does DNSCrypt mask/hide the URLs I visit

I use DNSCrypt (https://dnscrypt.org/) and I'd like to know whether it's useful to mask/hide from my ISP (Telecom) the HTTP requests I make in my browser. And how does it protect me? Thanks
7
votes
2answers
80 views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
0
votes
1answer
29 views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
2
votes
1answer
85 views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
4
votes
2answers
92 views

Amazon keeps asking for login/cc info via unsecure page - DNS hijack?

All my computers in the house will not connect to Amazon.com, but some unsecure (http) Amazon login page. This is the second time I'm having this issue. The first time I resolved it by changing my ...
6
votes
1answer
345 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
2
votes
2answers
24 views

DNS IP address auto reset

I have a unofficial Windows and i noticed that my internet connection gets reset. By taking a closer look at it, i found that the DNS server address is set to an IP in China. Any reason why this ...
2
votes
1answer
50 views

Fixing DNS leak - transparent proxy

My ISP is using a transparent proxy to intercept my DNS lookup requests when using VPN. Is there a way to prevent that? I am using Lubuntu if that makes any differance.
4
votes
1answer
117 views

Investigating a possible rogue DNS Server (maybe DNSChanger)

One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to ...
-1
votes
1answer
53 views

When I visit a site using HTTPS is it exposed to sniffers? [duplicate]

Say for example I visit https://foo.com. Could someone that is sniffing the network determine that I am going there? At what level does the https encrypt the request? I know that data is secured ...
2
votes
1answer
56 views

Types of risks for my router

Recently I've read about viruses and worms that attack routers and do some nasty things, incl. DNS changes etc. In the beginning, I just read that some people have issues that their DNS server address ...
1
vote
1answer
22 views

What are the real risks of enabling unsecure DNS updates on Active Directory intranet domain?

Based on my current research, enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN. While this works fine for Windows machines ...
4
votes
1answer
192 views

Can it be dangerous to use not popular(unknown) dns servers?

There is a service called tunlr, which let's you browse the web with no restrictions(Pandora, Hulu etc.). You just have to use their dns server. But now I'm concerned whether the owners of the dns ...
2
votes
2answers
158 views

Does DNS-based blocking protect against ransomware?

I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, ...
1
vote
1answer
76 views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
-2
votes
1answer
67 views

Why does ikea.com always redirect to ikea china?

Background: This question has been raised here and marked as duplicate. However, it is not fully addressed. To reproduce (not exactly): Set your DNS to 180.76.76.76 (the Baidu DNS ...
5
votes
1answer
133 views

My dlink router seems to be compromised

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 ) Just out of curiosity about what I would find, I tried to send some ...
1
vote
1answer
168 views

How to bypass DNS spoofing protection

I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?
4
votes
1answer
116 views

How important is split-horizon DNS?

Split DNS returns different results depending on the source IP. It's commonly promoted as significant security measure for internal resources, for limiting enumeration and discovery. I've had many ...
5
votes
1answer
324 views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
1
vote
0answers
141 views

'google.com' DNS resolved to addresses of ISP

When I open cmd.exe and do nslookup on google.com I am getting a set of addresses that belong to my ISP. More than that, even when I try to run server 8.8.8.8 or server 8.8.4.4 and query for ...
1
vote
1answer
45 views

Using a Firewall to Trigger Truncation in DNS UDP Response

Assume I am a firewall between client and server. If the client sends a DNS query with UDP, I should response this query with set the truncated flag=1. As a result, the client will be forced to use ...
1
vote
3answers
168 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
3
votes
1answer
314 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
1
vote
1answer
98 views

Does using FreeDNS introduce a security risk?

If you use a service like FreeDNS for a DNS, does this introduce any additional security risk as opposed to simply paying a registrar? Obviously the owner of FreeDNS could hijack your domain. But ...
2
votes
3answers
101 views

TLS domain name mismatch

Suppose I want to talk to example.com over TLS the and server I am redirected to is foo.com. But during the handshake it can prove it holds the private key that matches example.com certificate. Why ...