2

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS server to resolve its domain name?

3

The victim does not need to use the attackers name server, although this can make things easier. The main idea is, that the original DNS record is under the attackers control and thus also the TTL (time to live) of this record:

  • Victim tries to access web site. To get the address it asks the companies DNS server. Because the record is not cached yet the DNS server recursively resolves the name and returns the record (from the attackers DNS server) to the victim.
  • If the victim needs to look up the IP address again (which can often be triggered by connection failures on the first IP) it will again ask the companies DNS server. If the record is cached the TTL gets checked. If the record is still valid it will be returned to the victim (with the old address). If it is not valid the companies DNS server will again recursively resolve the name and at the end get the new record from the attackers DNS server.

Another option would be for the attacker to return an answer which contains already both IP addresses (the good and the bad one). The victim will first use the good address. Once this stops working (which can be triggered by the attacker) the victim will retry with the alternative (bad) IP address.

  • Since DNS pinning would cause security flaws, How can we prevent DNS Rebinding attacks? – Pacerier Mar 29 '15 at 7:07
  • @Pacerier: I don't think that DNS pinning itself is a security flaw (even after reading the link you provided). But DNS pinning can often be easily circumvented by simply not responding to the original IP in which case most browsers to another DNS lookup. Anyway: DNS pinning is a problem which needs to be fixed on the server side by checking the HTTP-Host header provided by the client and only accepting requests where the host header points to a name served by the server. – Steffen Ullrich Mar 29 '15 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.