I'm in a process of learning how to perform a DNS cache poisoning attack.
I run everything on an isolated VM environment, for educational purposes only.
The setup is a linux machine with
Unbound DNS Server configured as a recursive resolver, which I try to poison.
For simplicity, I allow myself to be MITM (for in and out packets).
dig to query the resolver for a domain name, for example,
The resolver queries some DNS server for an answer.
Then, using scapy and python-nfqueue, I catch the final result packet, and change the answer so it will contain only an NS name
(ns1.google.com, sometimes ns2 etc) as an NS record, and an additional record of
ns1.google.com with an IP of
Now, I stop the poisoning script, and I expect that the next time I query a subdomain like
www.images.google.com, the poisoned resolver would recognize
www.images.google.com as a subdomain of
google.com, thus will attempt to query
220.127.116.11 using the cached record.
However it is not happening, and the resolver attempts to query an outer DNS server instead using the cache.
Any idea what am I missing?