I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected computers are going to be redirected. But in the case when the server is not mine? How can I edit a DNS server of others?
Add a comment
|
2 Answers
One option is DNS cache poisoning - compromising a DNS server and changing entries there (making security.stackexchange.com point to the IP used by facebook.com). Clients of this server and other DNS servers, that cache the information from the server you compromised, will cache the incorrect entry and will redirect its users to facebook.com. But if the domains are protected by DNSSEC this attack would be most likely unsuccessful.
Another option is DNS hijacking - forcing a client use your malicious DNS server instead of a genuine one. Done by manipulating the victim host's TCP/IP settings.
Probably needless to say that doing any of this is entering the black-hat (or at least grey-hat) territory as you need to attack vulnerable servers/clients.
Some blogs about vectors of DNS-related attacks, if that was what you're interested in:
https://www.silicondiscourse.com/2017/03/home-routers-and-dns-attack-vectors/
https://blog.malwarebytes.com/cybercrime/2015/09/dns-hijacks-what-to-look-for/
DNS poisioning attacks are when you change the servers the target machine uses to make DNS lookup requests to. This attack can be done for example by compromising the DHCP server and changing it there, or ensuring the target receives your deployed spoof DHCP server reply when they initially make a request instead, or you can compromise the target machine and change it locally. That said in Windows for example if you have the ability to compromise the target machine locally you can compromise the HOSTS file or conduct other OS level attacks at that point anyway.
