0

Each DNS request has an ID of 16bits. In the event that an adversary is unable to sniff the query, a way to spoof the DNS reply is to flood the resolver with many replies.

Request from victim

 Query ID: 1ac23
 What is the ip address of www.example.com

Spoofed replies from adversary

 Reply for ID 0001
 The ip address of www.example.com is 123.123.123.123

 Reply for ID 0002
 The ip address of www.example.com is 123.123.123.123

 Reply for ID 0003
 The ip address of www.example.com is 123.123.123.123

 ....

 Reply for ID 1ac23
 The ip address of www.example.com is 123.123.123.123

 ....

My question is, if the adversary can't sniff the ID (or the request itself) in the first place, how does the adversary find out the domain that is requesting resolution, in this case www.example.com?

1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.