I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is
www.blalba.com 80000 A 220.127.116.11
I thought that was enough to redirect users to 18.104.22.168 but when I try to get IP address of www.blalba.com with nslookup command DNS server still gives me the correct answer.
What I'm sending to DNS server is like this;
;; ANSWER SECTION:
aaaa.blabla.com. 120 IN A 22.214.171.124
;; AUTHORITY SECTION:
aaaa.blabla.com. 86400 IN NS www.blabla.com.
;; ADDITIONAL SECTION:
www.blabla.com. 604800 IN A 126.96.36.199
When I look DNS cache I could find aaaa.blabla.com 188.8.131.52 record also the additional record.
Is there anything wrong with my method or my DNS server?