0

As I understand after a Domain Name is resolved to a specefic IP through DNS www.example.com resolves to 10.10.10.10, this cache is saved in RAM in a computer for a little bit, AKA five or so minutes. (Note: Correct me if I'm wrong)

So, when I DNS spoof a computer to resolve www.whatevs.com to the IP of my website clone running on my local apache server: 192.168.1.5 . Then it does what it does and it is finished. But, the problem is after the attack is finished and I stop DNSSpoofing, the computer saves www.whatevs.com to 192.168.1.5 for a little while after, before it runs a DNS resolution lookup again to resolve the real IP. Does anyone know how to stop this by making the computer lose the cache, or forget www.whatevs.com's fake IP address, so it must re-resolve it? Thanks!

Improve this question
1

DNS TTL is used to decide how long we want the entry to be cached on the local machine. Advertise smaller TTL (DNS server/Responder does this) so that the entry will be flushed at the configured time :-)

Try it out. Its fun.

Good luck.

Improve this answer
0

It's not the computer's RAM, its the DNS cache where this info is held, and it's held there till it expires. I believe the default (on Windows) is 1 day.

To purge it earlier, run (on victim machine):

  • Windows: ipconfig /flushdns
  • Linux (various, google for specific version)
  • OSX - sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponder

Note: Don't forget to purge the DNS cache on any upstream DNS Servers you may have poisoned as well, if necessary.

Improve this answer
  • Could I just set the TTL (Time To Live) to one second that way after they do the 'bad activity' the DNS is never cached, it must be re-resolved directly after? – Creg Oct 17 '16 at 13:00
  • In theory, but I would test it to be sure – HashHazard Oct 17 '16 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.