I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS).

What I understand from the source code is that the the recon server is used to find the authoritative nameserver for the domain we are spoofing. But why can't the target name server be used for this? Is it so that the target host doesn't get cached during the lookup?


From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses.

If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. If they were doing this in combination with sending the malicious requests from a spoofed IP, a network admin in charge of the target DNS server could notice the two IPs making requests regarding the same malicious hostname, and easily determine which one is spoofed and which one is a real originating IP.

So, this makes it possible for an attacker to fully disguise the source of the attack.

  • That makes sense. So technically one could use the same nameserver as both recon and target? – pepsi Feb 25 '13 at 22:02
  • Yep, if you didn't care about spoofing your source IP. You should have no problem setting the server as both recon and target. There might be something I'm missing due to not being intimately familiar with the method, but it should work okay. – Anorov Feb 26 '13 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.