I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. You somehow manage to find victim.com DNS server, poison the cache there and just wait for your victim to connect
or 2. You bombard victim.com with resolved queries from a previously setup DNS server, which queries are of course forged.
So my question is : Is scenario 2 possible in any way? Because i couldn't find a reason why it would not work, and knowing my luck there's a simple answer to that.
Here's the paper I've been reading about it : SANS