0

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered the IP address of a website directly I will not be a victim of DNS cache poisoining ??

  • Even if you may not be a victim of that specific threat, do not think that you will achieve a lot in most cases: besides the problem of mass hosting (that needs the HTTP host header with a name and for HTTPS the SNI extension with an hostname too), the blob of HTML you will get will be full of links to content (images, javascript, css, fonts, etc.) using again hostnames. So if you are under some active threat, even if you manage to get the content, then it will be mostly useless. – Patrick Mevzek Mar 15 at 20:28
2

So If I entered the IP address of a website directly I will not be a victim of DNS cache poisoning ??

This depends on the web server its configuration. Often web server use virtual hosts in order to host multiple domains on the same web server.

Based on the domain name, the content of the web page is routed to the proper content directory for that specific domain.

The generic answer to your question is most likely "no!" because of the above described inner working. The only exception is when one domain is served on a specific IP address. In that case it might be possible.

In order to overcome DNS cache poisoning, one could edit the hosts file where the domain is pointed to a specific IP address. The hosts file lookup is performed before any DNS queries take place.

Please note that when DNS changes are applied to a specific domain, your hosts requires updating as well. Although this will work for some time, it is not the best solution.

The best way to prevent such attacks is to use DNSSEC as it allows you to authenticate DNS messages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.