7

I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is ;additional www.blalba.com 80000 A 1.2.3.5 I thought that was enough to redirect users to 1.2.3.5 but when I try to get IP address of www.blalba.com with nslookup command DNS server still gives me the correct answer.

What I'm sending to DNS server is like this; ;; ANSWER SECTION: aaaa.blabla.com. 120 IN A 1.2.3.4 ;; AUTHORITY SECTION: aaaa.blabla.com. 86400 IN NS www.blabla.com. ;; ADDITIONAL SECTION: www.blabla.com. 604800 IN A 1.2.3.5 When I look DNS cache I could find aaaa.blabla.com 1.2.3.4 record also the additional record. Is there anything wrong with my method or my DNS server? Thanks.

| improve this question | |
  • 2
    Old DNS bug is old. – rook Jan 18 '15 at 16:42
  • You mention that you achieved to insert a line www.blabla.com => 1.2.3.5 and later you say that you can find aaaa.blabla.com => 1.2.3.4. So what did you actually achieve and what is the issue? – Michael Jan 19 '15 at 14:03
  • www.blabla.com is the additional record in the cache. aaaa.blabla.com is the normal a record. What I was trying to do is to redirect usert to 1.2.3.5 when they try to connect www.blabla.com . But when I use nslookup command with www.blabla.com the result is not 1.2.3.5 but the real address. – mbaydar Jan 19 '15 at 19:03
  • This bug based on weak prng, which attacker can predict. but this bug already fixed ;( – YBW May 31 '15 at 0:52
1

Since you can see the DNS cache has the poison in it, it sounds like you're doing the poisoning successfully. My best guess:

The DNS server the machine running nslookup is configured to use isn't the one that's being poisoned. (In other words, you're poisoning the bind server you set up, but nslookup is causing lookups to, say, your ISP's DNS servers, or Google's or OpenDNS'.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.