I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is ;additional www.blalba.com 80000 A I thought that was enough to redirect users to but when I try to get IP address of www.blalba.com with nslookup command DNS server still gives me the correct answer.

What I'm sending to DNS server is like this; ;; ANSWER SECTION: aaaa.blabla.com. 120 IN A ;; AUTHORITY SECTION: aaaa.blabla.com. 86400 IN NS www.blabla.com. ;; ADDITIONAL SECTION: www.blabla.com. 604800 IN A When I look DNS cache I could find aaaa.blabla.com record also the additional record. Is there anything wrong with my method or my DNS server? Thanks.

  • 2
    Old DNS bug is old.
    – rook
    Commented Jan 18, 2015 at 16:42
  • You mention that you achieved to insert a line www.blabla.com => and later you say that you can find aaaa.blabla.com => So what did you actually achieve and what is the issue?
    – Michael
    Commented Jan 19, 2015 at 14:03
  • www.blabla.com is the additional record in the cache. aaaa.blabla.com is the normal a record. What I was trying to do is to redirect usert to when they try to connect www.blabla.com . But when I use nslookup command with www.blabla.com the result is not but the real address.
    – mbaydar
    Commented Jan 19, 2015 at 19:03
  • This bug based on weak prng, which attacker can predict. but this bug already fixed ;(
    – YBW
    Commented May 31, 2015 at 0:52

1 Answer 1


Since you can see the DNS cache has the poison in it, it sounds like you're doing the poisoning successfully. My best guess:

The DNS server the machine running nslookup is configured to use isn't the one that's being poisoned. (In other words, you're poisoning the bind server you set up, but nslookup is causing lookups to, say, your ISP's DNS servers, or Google's or OpenDNS'.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .