What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?
for example : IP , Port number and Transaction number what else ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There are a number of different possible vectors for DNS cache poisoning. Generally, it is an attack against a DNS server that clients use and the attacker is trying to target their attack, they only need to know the DNS server that the client uses. If the DNS server is resistant, another approach could be to try and actually spoof the DHCP response to get the target system to connect to the wrong DNS server. If that doesn't work, the attacker could try to compromise a DNS server that the target's DNS server might ask for help resolving a domain.
None of these require knowing the IP. The DHCP requires knowing the MAC address to target one system. I'm not sure how port number would be relevant to DNS poisoning since DNS servers operate on standard ports and the attack isn't generally against the targeted client. I'm not sure what you mean by transaction number.
The classic DNS cache poisoning attack works like this:
Someone queries a DNS resolver for example.com. The resolver will ask the authoritative server for example.com for its ip-address. This server, however, will respond with an additional DNS records for another domain. In the past many DNS resolvers cached the faked record for the other domain, too.
This attack is not related to faking DNS response packets, which is another common attack on DNS. In order to fake packets, the ip-addresses and ports of both ends need to be know or guessed by the attacker.