The Domain Name System (DNS) translates Internet domain and host names to IP addresses.
4
votes
5answers
120 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
8
votes
2answers
202 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
-6
votes
1answer
61 views
may DNS companies track visitors by traffic analysis? [closed]
Internet is based on name servers, we always type stackexchange.com in address bar to access this website no stackexchange's IP address. as ICANN is managing every DNS records for every website where ...
-1
votes
1answer
271 views
How does DNS work?
I'm learning pentesting from books. So far I thought I know about DNS but now I'm completely lost and confused.
well, I know what happens when you enter domain name in your browser:
Say, I've ...
20
votes
3answers
716 views
What are some risks of purchasing a “used” domain name
If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
2
votes
1answer
100 views
External network DNS spoofing
I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. ...
-1
votes
1answer
62 views
Redirect attack [closed]
I just discovered that our server other's website for example: http://destiny.mbtosi.com/styles/new/images/no.png should say "This Web Page no longer exists." but in 50% hits it shows an image from ...
4
votes
3answers
354 views
Does DNS pinning protect against all DNS rebinding attack?
I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers".
Figure 1: An example of a dynamic pharming attack ...
0
votes
1answer
65 views
The importance of changing DNS when Using Antifiltering software
Is it safe that sometimes my Anti-filtering program does not change the DNS address?
15
votes
3answers
930 views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
5
votes
2answers
3k views
How can I detect/withstand DNS amplification attack?
I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
1
vote
1answer
92 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
4
votes
2answers
684 views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
14
votes
7answers
952 views
Would it be possible to overload a large part of the internet, and if so then how?
Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
2
votes
2answers
340 views
DNS Spoofing vs DNS Cache Poisoning
What is the difference between DNS Spoofing and DNS Cache Poisoning ???
It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
2
votes
1answer
96 views
How to verify DNSKEY by using its corresponding DS
A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
The ...
5
votes
2answers
467 views
Could somebody explain how DNS poisoning might occur in this scenario?
I read the following statement in a security blog
using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning
Could somebody ...
0
votes
3answers
439 views
To DMZ, or not to DMZ
So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network.
The 'networks' are:
Internal network
DMZ
The internet
And the servers we ...
0
votes
1answer
142 views
DNS Cache Poisoning and Snooping
I'm trying to do two things here.
The first is poison the cache of a target DNS server. A scan has suggested the network I'm attacking is vulnerable to CVE-1999-0024.
My understanding of this ...
5
votes
3answers
169 views
Why would you want to run DNS servers externally?
Something that's never made much sense to me is when environments have DNS servers which are publicly accessible (on the internet). This more often than not seems to leave them vulnerable to Cache ...
4
votes
1answer
162 views
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
3
votes
1answer
88 views
Why is a separate reconnaissance server needed for DNS cache poisoning?
I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS).
What I understand from the ...
5
votes
2answers
316 views
Is this a DNS attack?
The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
3answers
269 views
Does NAT break source port randomization?
The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.
Does NAT break the security benefits of source port randomization?
In more detail, consider ...
-1
votes
3answers
253 views
Available alternative DNS protocol not another dark-net [closed]
Hi does any one knows any DNS alternative Protocols ?
If so what is the most used ?
Is easy to setup ?
Is easy to have two DNS protocols one where you connect to the Common Internet and the other ...
0
votes
2answers
556 views
Anyone out there using Umbrella from OpenDNS? What exactly is it?
I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
1
vote
1answer
287 views
What is a DNS leak?
I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
4
votes
6answers
10k views
Are services like Hide My Ass and UnoDNS reasonably safe to use?
While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services:
A VPN: https://hidemyass.com/vpn/promo/1/5/
A DNS: http://www.unotelly.com/unodns/
I an ...
2
votes
2answers
220 views
DNS cache poisoning
What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?
for example : IP , Port number and Transaction number
what else ?
3
votes
3answers
245 views
Are there DNS analysis tools that could detect bad DNS results?
Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results?
It would be very simply to detect an attack along the ...
4
votes
1answer
116 views
When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?
I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least).
Is there consolidated test ...
1
vote
1answer
79 views
DNS Cache poisioning examples, or other criteria when a client ignores a response
Is there a concise set of rules that describe what 99% percent of DNS responders accept?
Conversely, are there are set of rules that define when DNS queries are invalid?
Example answer
I would ...
-2
votes
1answer
101 views
how to protect against this vulnerability CVE-2012-5166 in the DNS [closed]
I need to know how to protect my DNS server of the vulnerability with iptables rules. Please can support me
3
votes
1answer
131 views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
5
votes
2answers
2k views
How can I identify open DNS resolvers in my network?
This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
4
votes
1answer
316 views
Which security risks are associated with alternative DNS providers?
I'm considering using an alternative DNS provider on my computer. Which risks do I run if I use one?
I already know that the DNS provider may return a malicious IP address when I'm trying to access ...
1
vote
2answers
125 views
anti virus acting up/DNS poisoning
I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks ...
4
votes
2answers
476 views
How do I find all domains hosted on a single host?
I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as ...
0
votes
1answer
176 views
DNS Vulnerabilities Scanner [closed]
I'm looking for a DNS Vulnerabilities Scanner tools, which is specially for DNS vulnerabilities, that shows me the Vulnerabilities, and the solution for that, like "Nessus" and "Acunetix" but just ...
3
votes
1answer
311 views
captive portal wikipedia article
Something on the wikipedia page regarding captive portals have confused me:
http://en.wikipedia.org/wiki/Captive_portal
When a client requests a website, DNS is queried by the browser. The
...
2
votes
0answers
374 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
0
votes
0answers
116 views
How to locate DNS information at localhost windows machine [closed]
Windows has some host information at hosts file, and I am wondering whether this file is picked up by DNS server if DNS server is set.
Or where is DNS information located at?
0
votes
1answer
193 views
How have DNS recursion attacks happened?
There are a few resources describing how to carry out DNS recursion attacks. Is there any good explanation to help me understand how these attacks work and if systems on my network are still ...
1
vote
2answers
1k views
DDoS Protection for DNS providers
Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
2
votes
1answer
94 views
How did DNSChanger rogue name servers work?
I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
15
votes
4answers
592 views
Global Blackout is a myth?
In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
3
votes
2answers
129 views
Unecrypted connection to server - safe?
I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL.
Now I always need an heroku addon to add my SSL certificates which costs $20/month.
Cloudflare ...
0
votes
1answer
646 views
tor and widecap dns leak
I am using a program that I coded in C#.
All it does is use HttpWebRequest to request some pages and read info from them.
I tried running it through Tor. I installed the Vidalia Bundle and Widecap.
My ...
1
vote
1answer
242 views
DNS query through squid? [closed]
My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?
Snort Alert:
ET POLICY ...
