2

if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and compare it with DNS response then how/where to get the correct information about it?

3

If you can collect the DNS info beforehand set that data in a prioritized host file. If not you'd have to force queries to near random DNS servers on the Internet, ideally from a completely separate network to avoid man in the middle modification (possibly via a cell phone on a carrier network) and compare the results to what you got from the questionable DNS server.

As to how to collect safe DNS/IP info verify the Certificates via TLS/SSL if the remote systems support TLS/SSL (possibly other protocols that also use certificates).

A well configured Split DNS implementation where the Internal DNS servers don't pull from your Externally facing DNS servers will prevent external poisoning of your internal DNS resolutions.

It's a great question and an interesting design flaw that we all have to work with.

I think the important part is knowing how to implement Split DNS properly so your internal hosts don't get poisoned.

You could also tunnel all of your DNS requests to a trusted server or set of servers to avoid the man in the middle problem.

The more complicated solution is to rewrite your DNS client to poll various trusted DNS servers to compare their results with your local one to detect DNS poisoning.

  • can i get directly the database of legitimate DNS records from somewhere? if not, then can you suggest me some free trusted DNS server's ip to create local database..@Trey Blalock – Vaibhav Kankal Mar 8 '17 at 8:00
  • @VaibhavKankal You can get a list of all the public DNS servers in the world here. scans.io As to which one's you can trust or not I haven't tested them all yet. If you trust Google you can start with theirs at 8.8.8.8 en.wikipedia.org/wiki/Google_Public_DNS – Trey Blalock Mar 8 '17 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.