Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

0
votes
0answers
41 views

What's DoH with PE [on hold]

I was reading this presentation and discovered "DNS over HTTPS with PE" but I didn't find any website talking about it. Can someone give me a link to find out what PE means? Thanks for the answer
1
vote
1answer
60 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
2
votes
2answers
119 views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
0
votes
1answer
36 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
3
votes
2answers
166 views

How does DNS over TLS prevent your ISP from seeing the websites you visit?

For example, I'm using DNS over TLS in Android Pie. This happens: I visit a website (google.com). I send a DNS query to the DNS server, and the response is the IP address of google.com. The ISP knows ...
0
votes
1answer
15 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
1
vote
2answers
105 views

Domain name vs IP only hosting?

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
0
votes
1answer
101 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
0
votes
0answers
64 views

Hiding IP Address/Geo Location Spoofing, VPN, Proxy, Proxy DNS or something else?

Let me explain the scenario. I am in country B, I have a subscription to the software that must be used while residing within Country A. In case of violation they will ban my subscription forever. ...
-3
votes
2answers
109 views

What are the damages when a CDN gets hacked?

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN: https://www.welivesecurity.com/2015/06/09/us-army-website-hack/ When ...
-1
votes
0answers
79 views

Wireshark Capture - Is this malicious traffic or am I being paranoid?

So I just reformatted an infected PC to openSUSE Linux and picked the GNOME desktop feature set. I wanted to confirm whether or not the PC was really clean already so I used Wireshark while being ...
1
vote
0answers
41 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
0
votes
1answer
49 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
-1
votes
0answers
89 views

Bettercap : DNS spoofing not working (does not redirect to desired IP)

I've tried DNS spoofing with both bettercap with no success (and it also doesn't work with ettercap). It still shows the normal website without redirecting. OS A (victim, Motorola phone) and B (...
1
vote
1answer
82 views

How to prevent MITM DNS attack by router [duplicate]

My landlord is very much a busybody and he has extreme political views. I suspect he is using a Windows program that communicates with the Wifi router to record what websites all the tenants are ...
0
votes
1answer
124 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
1
vote
1answer
61 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
0
votes
0answers
22 views

Reverse DNS lookup of malicious IP resolving to “.” [duplicate]

Checking my iptables config for something unrelated, I happened to note that fail2ban had blocked an IP that iptables -L showed as follows: DROP all -- . anywhere Curious, ...
2
votes
0answers
36 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
0
votes
1answer
125 views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
0
votes
1answer
536 views

What's the difference between DoH and DoT? [closed]

I'm currently studying the new technologies: DNS-over-https (DoH) and DNS-over-TLS (DoT). I already read the RFC for both of this technologies. To test DoH, I'm working with Firefox (nigthly build). ...
0
votes
1answer
56 views

DNS resolution when typing IP address into the browser instead of domain

I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com. Given the understanding of how DNS works I have, to work ...
2
votes
1answer
67 views

OpenVPN configuration and ISP's DNS

I have configured OpenVPN server for using Clouflare DNS - 1.1.1.1. I use OpenVPN connection in the next way: sudo openvpn --config Config.ovpn on my local machine in WiFi network. My ISP provider ...
1
vote
1answer
57 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
2
votes
2answers
124 views

What are the implications of activating “obtain DNS server address automatically”?

There's a (private, password-protected) WiFi network (not under my control) which at first did not work* for my laptop - until I disabled the option that caused it to use google's DNS server. [*] not ...
0
votes
1answer
49 views

How secret is a dyn dns address?

If I register with a dyn DNS service and am allowed to select my own prefix, how secret is the URL? For example: I register with a dyn DNS service and ask for my prefix to be 204e9800998ecf8427e and ...
-1
votes
0answers
21 views

Gateway firewall basics & managing multiple elastic IPs to non-http services

I've been trying to make sense of this for months now. If this is too broad, or more appropriate for another forum please say so. I would appreciate at least a lead to documentation, as I simply ...
-1
votes
0answers
52 views

DNS/CA/MITM Attack proof web hosting by relying on a public blockchain

I'm working on an interesting project, related to blockchain, smart contract and security in internet communications / web content serving. The main goal is to reduce risks of HTTP man in the middle ...
0
votes
1answer
78 views

How to force users on my LAN to use a specific DNS server with arp poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
4
votes
1answer
84 views

Why does majority of the publicly routable IPs seem to have no rDNS assigned?

I built a Hilbert curve showing which IP addresses have rDNS assigned, based on one of the rDNS scan snapshots available on scans.io. I ended up getting the following (white means "assigned"): Is ...
1
vote
1answer
95 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
19
votes
5answers
5k views

Does DNS allow third parties to register subdomains?

I have one of those questions that rely on the rule sets for DNS lookup. Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
0
votes
0answers
36 views

How can I find the publick key length of a dnssec public key

I have generated a DNS public-key (as far as I recall it is an rSA key). Given the key (ZSK and KSK), how can I figure our its length? how can I make sure it is RSA or another type? For example, this ...
0
votes
1answer
57 views

How do I know if I can trust a DNS service

How can I decide if I could trust a given DNS service as a user? For example I have just seen DNS-Watch which tells me that it is secure and that they don't log anything. How can I decide if the ...
0
votes
1answer
82 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
-2
votes
1answer
67 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
145 views

What are the possible solution for blocking VPN connection on a home network?

I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
4
votes
2answers
144 views

How can I prevent abuse of our public WiFi network?

One of our customers runs a holiday park with <100 users on it. We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been ...
6
votes
2answers
1k views

Strange Problem - DNS Cache Poisoning?

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home: About three times now in the past year, when I open some website - I'm thrown ...
2
votes
0answers
26 views

DNS search lists cause ambiguity, but what are practical examples of this?

Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
2
votes
1answer
228 views

Difference between DNS flood attack and DNS amplifier attack [duplicate]

I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them? It ...
38
votes
4answers
6k views

How could a public DNS server return bad results?

I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people). In our country, YouTube, Twitter, Facebook and many other ...
1
vote
0answers
36 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
4
votes
1answer
144 views

What information is still exposed when visiting an HTTPS website using DNS over TLS?

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
0
votes
1answer
58 views

Is there any security reason to prefer local IP address over zeroconf “.local” domain name?

I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" ...
2
votes
3answers
89 views

Whitelisting DNS vs. Packet filtering Firewall

I am an information security intern for a MSP. The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does ...
0
votes
1answer
44 views

SSL with shared webmail URL

I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS. Now I created CNAME records on my domain to ...
0
votes
0answers
20 views

How many CAA record entries should be given/provided as a response?

If there are around 30 CAA record entries of a particular domain in the CAA record, should we return all as a response ? I did not find any info on this in RFC6844. Please advise. Thanks
0
votes
3answers
770 views

1.1.1.1 Cloudflare encrypted DNS.Does it still leak IP addresses?

1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its ...
2
votes
0answers
157 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...