# DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack.
I run everything on an isolated VM environment, for educational purposes only.

The setup is a linux machine with Unbound DNS Server configured as a recursive resolver, which I try to poison.

For simplicity, I allow myself to be MITM (for in and out packets).
I use dig to query the resolver for a domain name, for example, www.google.com.

The resolver queries some DNS server for an answer.
Then, using scapy and python-nfqueue, I catch the final result packet, and change the answer so it will contain only an NS name (ns1.google.com, sometimes ns2 etc) as an NS record, and an additional record of ns1.google.com with an IP of 6.6.6.6.

Here's a printscreen from Wireshark (of the final answer packet I modified):

And here's a proof that the cache is poisoned:

Now, I stop the poisoning script, and I expect that the next time I query a subdomain like www.images.google.com, the poisoned resolver would recognize www.images.google.com as a subdomain of google.com, thus will attempt to query ns1.google.com at 6.6.6.6 using the cached record.

However it is not happening, and the resolver attempts to query an outer DNS server instead using the cache.

Any idea what am I missing?

• How you are so sure that google is vulnerable fr DNS cache poisoning? That might have already been patched. – Adithyan AK Feb 6 '18 at 6:41
• What value are you setting for the TTL field? – autistic Feb 6 '18 at 7:32
• I wonder if you query the poisoned DNS about images.google.com with "Recursion desired" bit disabled, will it return 6.6.6.6? – Strigo Dec 13 '18 at 13:26