Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

1
vote
0answers
90 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
1
vote
0answers
34 views

An unknown domain serving contents of my sites [migrated]

I found that an unknown domain like www.aaa.com serving exactly the same contents (html, js ,css, any asset) of my site: myname.me. And the API as well, for example, www.aaa.com/api/user get the ...
0
votes
0answers
46 views

Why is the attacker allowed to create DNS traffic in a DNS cache poison attack?

According to this article, a DNS cache poisoning attack is performed the following way: Send a large number of resolution requests each spoofed with different source IP information for www....
0
votes
1answer
58 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
0
votes
0answers
45 views

How to respond domain fluxing happening on workstations

A few workstations have been making dns requests to what looks to be DGA domains and talked to the security appliance vendor with little help. A vendor technician told me that some Apple servers ...
0
votes
1answer
122 views

Level 3 DNS default response for invalid host names

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.). For work I use a company VPN. On ...
0
votes
1answer
73 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
2
votes
1answer
98 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
2
votes
3answers
102 views

What happen when a local device have the same IP as an external website

When I enter 'google.com' in my web browser, my computer goes to the DNS server and gets Google's server IP address, then it look for that address in the local network and when it doesn't find it it ...
0
votes
1answer
97 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
-1
votes
1answer
43 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
1
vote
2answers
73 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
1answer
53 views

Data retrieved from DNSDB [closed]

I queried amazon.com using lookup API from DNSDB "https://api.dnsdb.info/lookup/rdata/name/amazon.com" and i got following response. qlightingcontrol.in. IN NS amazon.com. qlightingcontrol.com.tw. ...
1
vote
0answers
55 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
0
votes
2answers
139 views

Spam Russian Subdomains on my Website

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website As you can see ...
1
vote
1answer
73 views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
0
votes
0answers
45 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
0
votes
1answer
56 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
0
votes
0answers
100 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
1
vote
0answers
74 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
0
votes
0answers
65 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
1
vote
1answer
89 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
-2
votes
2answers
140 views

how does DNS cache snooping work?

I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using. Also, from what ...
0
votes
1answer
51 views

Are those animated video thumbnails generate the same DNS from actual videos?

I have a very technical question about the latest feature shown on those video platforms, like YouTube and other. There’s been a trend lately that the classic still image thumbnails have been ...
0
votes
1answer
57 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
1
vote
2answers
62 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
1
vote
1answer
53 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
0
votes
1answer
56 views

How to direct devices by hacking a router changing the DNS settings?

If I hacked a router's admin panel outside my network, is it possible to direct all devices in that network to any website I want by DNS settings? If it is possible, how?
2
votes
1answer
71 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
1
vote
1answer
94 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
2
votes
2answers
1k views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
0
votes
1answer
66 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
4
votes
2answers
675 views

How does DNS over TLS prevent your ISP from seeing the websites you visit?

For example, I'm using DNS over TLS in Android Pie. This happens: I visit a website (google.com). I send a DNS query to the DNS server, and the response is the IP address of google.com. The ISP knows ...
0
votes
1answer
74 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
1
vote
2answers
114 views

Domain name vs IP only hosting?

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
0
votes
1answer
146 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
-3
votes
2answers
199 views

What are the damages when a CDN gets hacked?

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN: https://www.welivesecurity.com/2015/06/09/us-army-website-hack/ When ...
1
vote
1answer
151 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
2
votes
1answer
117 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
1
vote
1answer
185 views

How to prevent MITM DNS attack by router [duplicate]

My landlord is very much a busybody and he has extreme political views. I suspect he is using a Windows program that communicates with the Wifi router to record what websites all the tenants are ...
0
votes
1answer
463 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
1
vote
1answer
217 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2
votes
0answers
53 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
0
votes
1answer
253 views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
0
votes
1answer
2k views

What's the difference between DoH and DoT? [closed]

I'm currently studying the new technologies: DNS-over-https (DoH) and DNS-over-TLS (DoT). I already read the RFC for both of this technologies. To test DoH, I'm working with Firefox (nigthly build). ...
0
votes
1answer
160 views

DNS resolution when typing IP address into the browser instead of domain

I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com. Given the understanding of how DNS works I have, to work ...
2
votes
1answer
86 views

OpenVPN configuration and ISP's DNS

I have configured OpenVPN server for using Clouflare DNS - 1.1.1.1. I use OpenVPN connection in the next way: sudo openvpn --config Config.ovpn on my local machine in WiFi network. My ISP provider ...
1
vote
1answer
69 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
2
votes
2answers
189 views

What are the implications of activating “obtain DNS server address automatically”?

There's a (private, password-protected) WiFi network (not under my control) which at first did not work* for my laptop - until I disabled the option that caused it to use google's DNS server. [*] not ...
0
votes
1answer
53 views

How secret is a dyn dns address?

If I register with a dyn DNS service and am allowed to select my own prefix, how secret is the URL? For example: I register with a dyn DNS service and ask for my prefix to be 204e9800998ecf8427e and ...