The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

3
votes
2answers
151 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
15
votes
4answers
3k views

What stops someone from just redirecting a HTTPS connection to a HTTP version of the site?

Let's say someone does an ARP spoofing or DNS poisoning attack to redirect traffic to their own web server. If the real site has an SSL/TLS certificate, would that stop the hacker from redirecting ...
2
votes
0answers
49 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
1
vote
1answer
44 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
5
votes
0answers
23 views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
3
votes
2answers
77 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
2
votes
1answer
55 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. ...
0
votes
1answer
71 views

Why is a DNS Amplification attack considered a DDoS attack?

My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victim's. The DNS responds to this IP address with a ...
0
votes
1answer
52 views

How do I protect myself when using a public network? [duplicate]

I'm in a hostel with plenty of software engineers. I want to make sure I have some protection. I quickly read about dnscrypt and some VPN solutions. What measures can I take to ensure my data ...
1
vote
1answer
36 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
0
votes
1answer
4k views

dns reflection attack vs dns amplification attack

Over the past few weeks I have heard discussions about a DNS reflection attack and a DNS amplification attack. Is there truly a difference between the two or are people just using 2 different names ...
1
vote
1answer
82 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
0
votes
1answer
111 views

DNS in DMZ or not and mail server architecture

I'm a new user in security.stackexchange.com, I'm a French junior admin sys, I enjoyed to come here! Spend the presentation. I wonder what server I put in DMZ zone, I know the DMZ zone is for all ...
3
votes
1answer
43 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
3
votes
1answer
34 views

What could you do with a PTR record of “localhost”?

In today's log summary from my SSH server, I found the following interesting entry: Illegal users from: 113.175.205.167 (localhost): 2 times Doing a DNS lookup on 113.175.205.167 does indeed ...
0
votes
1answer
48 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
2answers
56 views

Why does our network firewall drop netbios-ns packets?

In our local domain environment, we use Sophos UTM to protect our network. When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
6
votes
2answers
704 views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
0
votes
1answer
36 views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
1
vote
1answer
152 views

Why include DNS client cookie in DNS server cookie computation?

The proposed standard for DNS cookies specifies that the server cookie is to be computed as follows: The Server Cookie SHOULD consist of or include a 64-bit or larger pseudo-random function ...
0
votes
1answer
89 views

How does a DNS provider provide SSL?

I use CloudFlare as my DNS provider for my domain, and I learned that they provide SSL. I was confused as to how a DNS provider can provide SSL because my communications between the client and my ...
3
votes
1answer
38 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
1
vote
2answers
43 views

Strange apple dns answers

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59 I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like ...
3
votes
1answer
109 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
3
votes
2answers
52 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
3
votes
1answer
91 views

Is DNS leak really an issue?

I'm reading about DNS leak and what threat it can pose to VPN users, for instance, this question. But generally, there's tons of similar topics on the internet. But what are people afraid of? I just ...
0
votes
0answers
27 views

Detecting Spamming activities of Botnets

Remarks Hello Everyone,thanks for being a nice platform for expressing Everyone's Doubts/Views. Problem Statement I want to detect spamming activity of botnets Background Information about ...
4
votes
2answers
119 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network ...
1
vote
3answers
135 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
1
vote
1answer
79 views

UDP DNS & Firewall

This question might be simple but please understand my lack of knowledge. I am seeing a lot of DNS packets dropped by our firewall (sophos SG125) by default rule 60001. There are three Domain ...
2
votes
1answer
181 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
0
votes
0answers
55 views

Do these DNS requests seem like Conficker/Torpig-like behaviour?

I'm at my wit's end on this one... I have been seeing weird traffic from an IP on a client's local network and I think the host is malicious. Looking at the traffic it is producing, is always ...
2
votes
1answer
68 views

DNSSEC: Why are RRSIGs returned in the “Answer” not “Additional” section?

Looking at Wireshark traces of DNSSEC responses, I see that the RRSIG is returned in the "Answer" section, even though it wasn't part of the query. Why isn't it returned in the "Additional" Section, ...
3
votes
1answer
45 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
0
votes
0answers
91 views

Script to emulate DNS for Windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...
0
votes
1answer
40 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
0
votes
1answer
381 views

trying to dns spoof using mitmf

I am trying to redirect a page of taulukko.com to google.com for learning purposes but no success. When i enter in the taulukko.com from the spoofed node i receive: The webpage cannot be found my ...
1
vote
3answers
107 views

Can a rogue DNS server see my passwords?

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my ...
7
votes
2answers
1k views

How can I stop someone from displaying my website on his domain?

I just discovered that someone is pointing their domain name to the server I use for a website, which results in traffic to their domain displaying the content of my website. How can I stop this ...
2
votes
1answer
58 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
0
votes
1answer
23 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
-1
votes
2answers
109 views

How risky is to to use external DNS servers? [closed]

My infrastructure doesn't have an internal DNS server, so I just forward any DNS request to external DNS servers by iptables rules. I wonder how risk that can be, and how easy is it to spoof DNS or ...
8
votes
1answer
130 views

In light of the glibc DNS vulnerability, why aren't Linux distros updating install images?

Doesn't that make the mere act of updating a newly installed Linux instance unsafe, since the initially installed package manager is vulnerable? Am I missing something? For example, the current ...
0
votes
1answer
56 views

Captive portal DNS tunneling

I recently had a meeting with a security researcher who told me about tunnelling over a captive portal using DNS. I have done some research into this but I was wondering what is the simplest way to ...
2
votes
1answer
65 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android ...
-1
votes
1answer
27 views

TLS and DNSCrypt

DNS traffic (requests and responses) has been encrypted by DNSCrypt. In this case, is hostname (https://www.example.com /destination IP adress) readable in transit by a third party during my TLS ...
0
votes
1answer
48 views

Plaintext DNS traffic in a WPA2 session?

The question I have is, in WPA2 session between the AP and client are DNS requests sent plain text? Trying to wrap my head around the latest glibc exploit. Thank you Ted
-1
votes
1answer
77 views

Can you be vulnerable to the glibc vulnerability in getaddrinfo if you trust your DNS?

I have read that the vulnerability is triggered by a DNS response. How can you be vulnerable if you trust your DNS servers? May your DNS servers redirect your request to other DNS that may be ...
11
votes
3answers
333 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
0
votes
1answer
169 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...