2

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. You somehow manage to find victim.com DNS server, poison the cache there and just wait for your victim to connect
or 2. You bombard victim.com with resolved queries from a previously setup DNS server, which queries are of course forged.

So my question is : Is scenario 2 possible in any way? Because i couldn't find a reason why it would not work, and knowing my luck there's a simple answer to that.

Here's the paper I've been reading about it : SANS

Improve this question
2
  • To reach the external network, must you pass through the internet ?
    – Francois Valiquette
    Apr 19, 2013 at 19:19
  • Yes, that's what i meant.
    – olipinski
    Apr 20, 2013 at 15:10

1 Answer 1

Reset to default
0

To do this you will have to spoof the IP address of the DNS server and if you must pass through the internet, the attack will probably won't work for two reasons:

  1. If the DNS server of the victim is in his intranet with a private IP number you won't be able to send the packet through the internet since private IP addresses from private ranges are not rooted over the internet.

  2. If you spoof a public IP address and you try to send it, your ISP will probably not root it and it will just drop the packet. Before rooting a packet some rooters check if it is plausible that the source IP came from a specific interface.

If you don't need to pass through the internet to reach the external network, your private router may root the packets depending of its configuration

Improve this answer
2
  • What do you mean that my router may do the trick? Could you please explain the process?
    – olipinski
    Apr 19, 2013 at 20:47
  • Well, let's say you have the IP 192.0.0.101/24 and you are connected through a switch that is connected to a router port with the address 192.0.0.1/24. Also, let's presume that your victim address is 192.0.1.101/24 and its switch is connected to the same rooter as you but on another port which have the address 192.0.1.1/24. Also, let's say that the DNS server is somewhere in 192.0.2.0/24. If you spoof the DNS server address the rooter will still root the packet even if it is impossible that the rooter gets a packet from 192.0.2.0/24 to 192.0.1.101 on interface 192.0.0.1 .
    – Francois Valiquette
    Apr 20, 2013 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.