New answers tagged

0

Like Trey says, the IP of the stub resolver (the one starting the DNS query) is not visible. The IP address visible would be the IP address of the DNS recursive server. Having said that, if you want to make the client IP visible, you can install the DNS resolver (BIND, djbdns) on the client itself.


1

Not exactly. Keep in mind you won't see requests from systems which either have the dns info cached or are using a dns server which has it cached. Likewise if you have someone visiting or attacking your site who is using an external dns server the dns query will likely come from the IP address of the dns server they are using and not the visitor/attackers IP ...


-2

Yes, each DNS request packet has it's origin included. That's how the response is capable of getting the record back to the requester. To learn more about what's in a DNS request packet and how they work take a look here: http://www.firewall.cx/networking-topics/protocols/domain-name-system-dns/160-protocols-dns-query.html


0

Answer to your question: Yes it helps. But it's a race against time. In cases if your computers were infected, the malware must still dial back to the attacker's C&C server to send over the encryption key over to encrypt your hard-disk and for the attacker to identify you so attackers would know who paid and which decryption key to release. Also, a ...


0

It is most likely that your router was infected and android takes its dns server from dhcp. There are a few driveby attacks that work on routers like this.


2

You can also search through http://www.namedroppers.com/. I had not personally used this before but a quick test showed that it does find adjacent domains fairly well. It looks like the online search is free but you have to pay to download the list. Disclaimer: I am not affiliated with http://www.namedroppers.com/ nor do I endorse their service.


1

I have done similar analysis in the past by downloading WHOIS datasets, for instance from here. The dataset has many useful fields including the domain name, the registrant information (name/address/ph). The dataset also spans multiple major TLDs like com,org,net,info,mobi,etc. Note that it is not free, but also not expensive from a product development ...


0

Split horizon DNS is a BAD idea. It basically makes DNSSEC impossible to implement reliably (there are workarounds but they are all unsatisfactory). The main advantage of split horizon DNS is that it makes it possible to hide internal network, but the same can be achieved by creating a subdomain and making sure its SOA servers are not accessible from the ...


3

For HTTP connections, and probably also some other protocols, your browser(or other client) will put the domain name in the Host: header. For example, a request might start something like this: GET / HTTP/1.1 Host: website.org ... Over an unencrypted connection, this would reveal the target domain. For TLS connections (most commonly, HTTPS), most clients ...


3

Does the client ever send the actual domain name in a request, when accessing the website, or does it exclusively use the IP address? The hostname is included in the HTTP request (HTTP is the protocol spoken when accessing a web site). E.g. access to http://www.example.org/foo results in: GET /foo HTTP/1.1 Host: www.example.org Additionally the ...


3

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate). From Wikipedia: DANE enables the administrator of a domain name to certify the keys used in that ...


12

I didn't know about this. Extremely interesting. It seems to work by trying to generate connections to long random subdomains that it controls, and it can probably collate the domain resolution requests from the calling DNS server. Fig 1: List of requests initiated by the browser that failed Under the hood it's the standard tracking using a zero size ...


29

This is a DNS resolution trick that could also be performed using non-http protocols but in this case is performed by using random hostnames and zero-pixel images via http. Look at the source code on the page and you will see a series of random 10-character subdomains requested for several URL's. These are very unique hostnames which neither your computer ...


1

The only single point of failure is your DNS provider is not redundant and it goes down, then your email is down. But most MTA's will keep resending the emails for 24 hours on failures. If the 2 different IP's you listed are assigned to the same machine - Then you will have a SPOF opportunity. But having multiple MX records point to the same IP is bad if ...


1

You didn't really get the meaning of the EXISTS, I believe. What you describe (allow example.com to send mail from example.org) would be INCLUDE! INCLUDE:example.com means see the spf record for example.com and apply the rules. EXISTS is much simpler. It means "If the given DN resolves to any address, it will match (no matter the address it resolves to)." ...


1

SPF uses qualifiers (Pass, HardFail, SoftFail, Neutral) in order to determine the validity level of a request. The qualifiers are determined by checking any or even all the following configured mechanisms: ALL: Matches anything not already defined by another mechanism will match the all mechanism A: If the domain name has an address record (A or AAAA) ...


3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


1

You can only use one key to sign the data… … However, it's way more convenient to use 2 pairs of key (ZSK & KSK). There are 2 important points to take into account: You need to regularly refresh the key (ZSK) used to sign the records. (For security reasons.) You need to be sure that the DS record in the parent zone corresponds to the key used in the ...


0

Another benefit to Split DNS that hasn't been discussed is recursion. It is best to disallow your internal DNS servers to perform recursive lookups. They could get a response that exploits a vulnerability leaving them compromised. Therefore offload this task to separate DNS servers or your public facing DNS servers. Its a great way to apply defense in depth ...


1

Even all your MX records point to a single IP address these records by themselvs are not the single point of failure, because the MX records themselves will not fail. The single point of failure is instead if you have only a single server managing the mail. And in this case it does not matter if this single server has a single or multiple IP addresses. It ...


2

No. Taken from Wikipedia (Single point of failure - Wikipeda): A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. SPOFs are undesirable in any system with a goal of high availability or reliability, be it a business practice, software application, or other industrial system. Since in your ...


4

No, you should not be worried, but you should be checking GitHub's server fingerprint rather then relying on IP addresses. With git command you do it only on first (ever) connection. If the public key (corresponding to the fingerprint) is in known_hosts file, subsequent connections to github.com cause only warning if the domain got resolved to a new IP ...



Top 50 recent answers are included