A DNS attack happens when an attacker can influence how your computer will resolve host/domain names.
That can happen if an attacker is able to:
- Change the DNS server IP address in the network settings on your computer
- Change the DNS server IP address in the network settings on your router
- Change the hosts file on your computer
- Intercept and change DNS responses that are going to your computer
- Poison the DNS cache of the DNS server you are using, or the cache of your router or your PC
- There are also other ways...
If that happens, the attacker can easily redirect you to sites you did not intend to visit. For example if you type in www.google.com in your browser, your browser will try to first resolve that host/domain name to an IP address. And if the attacker is controlling the way your PC does that, he can send you any IP he wants that you will then visit instead of the IP of www.google.com.
When using the ToR browser, your PC is not resolving the host/domain name to an IP address, but the ToR exit node does that. If the ToR exit node is attacked, you could again be redirected to wrong destinations.