DNS Spoof saves IP to Domain Name after attack is finished, Is there a way to stop this?

Question

As I understand after a Domain Name is resolved to a specefic IP through DNS www.example.com resolves to 10.10.10.10, this cache is saved in RAM in a computer for a little bit, AKA five or so minutes. (Note: Correct me if I'm wrong)

So, when I DNS spoof a computer to resolve www.whatevs.com to the IP of my website clone running on my local apache server: 192.168.1.5 . Then it does what it does and it is finished. But, the problem is after the attack is finished and I stop DNSSpoofing, the computer saves www.whatevs.com to 192.168.1.5 for a little while after, before it runs a DNS resolution lookup again to resolve the real IP. Does anyone know how to stop this by making the computer lose the cache, or forget www.whatevs.com's fake IP address, so it must re-resolve it? Thanks!

Answer 1

DNS TTL is used to decide how long we want the entry to be cached on the local machine. Advertise smaller TTL (DNS server/Responder does this) so that the entry will be flushed at the configured time :-)

Try it out. Its fun.

Good luck.

Answer 2

It's not the computer's RAM, its the DNS cache where this info is held, and it's held there till it expires. I believe the default (on Windows) is 1 day.

To purge it earlier, run (on victim machine):

• Windows: ipconfig /flushdns
• Linux (various, google for specific version)
• OSX - sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponder

Note: Don't forget to purge the DNS cache on any upstream DNS Servers you may have poisoned as well, if necessary.