Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

0
votes
1answer
40 views

Data retrieved from DNSDB

I queried amazon.com using lookup API from DNSDB "https://api.dnsdb.info/lookup/rdata/name/amazon.com" and i got following response. qlightingcontrol.in. IN NS amazon.com. qlightingcontrol.com.tw. ...
1
vote
0answers
47 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
1
vote
1answer
67 views

Spam Russian Subdomains on my Website

I'm new to the forum, but I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-...
0
votes
0answers
38 views

Best tool to check list of subdomains for possible takeover? [on hold]

What is the best way to check a massive list of subdomains for possible takeover?
1
vote
1answer
64 views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
0
votes
0answers
37 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
0
votes
1answer
47 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
0
votes
0answers
74 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
1
vote
0answers
64 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
0
votes
0answers
6 views

Problem manually configuring DNS on Windows [migrated]

Comcast is my ISP. I have my Comcast rented gateway set in bridge mode with a DD-WRT unit to avoid the Comcast locked DNS. I can change the DNS server address in my Linux boxes in /etc/resolv.conf, ...
0
votes
0answers
43 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
1
vote
1answer
85 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
-2
votes
2answers
129 views

how does DNS cache snooping work?

I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using. Also, from what ...
0
votes
1answer
49 views

Are those animated video thumbnails generate the same DNS from actual videos?

I have a very technical question about the latest feature shown on those video platforms, like YouTube and other. There’s been a trend lately that the classic still image thumbnails have been ...
0
votes
1answer
54 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
1
vote
2answers
52 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
1
vote
1answer
52 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
0
votes
1answer
53 views

How to direct devices by hacking a router changing the DNS settings?

If I hacked a router's admin panel outside my network, is it possible to direct all devices in that network to any website I want by DNS settings? If it is possible, how?
2
votes
1answer
64 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
1
vote
1answer
80 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
2
votes
2answers
646 views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
0
votes
1answer
47 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
3
votes
2answers
408 views

How does DNS over TLS prevent your ISP from seeing the websites you visit?

For example, I'm using DNS over TLS in Android Pie. This happens: I visit a website (google.com). I send a DNS query to the DNS server, and the response is the IP address of google.com. The ISP knows ...
0
votes
1answer
39 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
1
vote
2answers
109 views

Domain name vs IP only hosting?

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
0
votes
1answer
116 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
-3
votes
2answers
154 views

What are the damages when a CDN gets hacked?

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN: https://www.welivesecurity.com/2015/06/09/us-army-website-hack/ When ...
1
vote
1answer
124 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
2
votes
1answer
91 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
1
vote
1answer
151 views

How to prevent MITM DNS attack by router [duplicate]

My landlord is very much a busybody and he has extreme political views. I suspect he is using a Windows program that communicates with the Wifi router to record what websites all the tenants are ...
0
votes
1answer
296 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
1
vote
1answer
166 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2
votes
0answers
52 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
0
votes
1answer
201 views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
0
votes
1answer
1k views

What's the difference between DoH and DoT? [closed]

I'm currently studying the new technologies: DNS-over-https (DoH) and DNS-over-TLS (DoT). I already read the RFC for both of this technologies. To test DoH, I'm working with Firefox (nigthly build). ...
0
votes
1answer
96 views

DNS resolution when typing IP address into the browser instead of domain

I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com. Given the understanding of how DNS works I have, to work ...
2
votes
1answer
77 views

OpenVPN configuration and ISP's DNS

I have configured OpenVPN server for using Clouflare DNS - 1.1.1.1. I use OpenVPN connection in the next way: sudo openvpn --config Config.ovpn on my local machine in WiFi network. My ISP provider ...
1
vote
1answer
68 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
2
votes
2answers
161 views

What are the implications of activating “obtain DNS server address automatically”?

There's a (private, password-protected) WiFi network (not under my control) which at first did not work* for my laptop - until I disabled the option that caused it to use google's DNS server. [*] not ...
0
votes
1answer
52 views

How secret is a dyn dns address?

If I register with a dyn DNS service and am allowed to select my own prefix, how secret is the URL? For example: I register with a dyn DNS service and ask for my prefix to be 204e9800998ecf8427e and ...
0
votes
1answer
120 views

How to force users on my LAN to use a specific DNS server with arp poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
4
votes
1answer
84 views

Why does majority of the publicly routable IPs seem to have no rDNS assigned?

I built a Hilbert curve showing which IP addresses have rDNS assigned, based on one of the rDNS scan snapshots available on scans.io. I ended up getting the following (white means "assigned"): Is ...
1
vote
1answer
164 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
19
votes
5answers
5k views

Does DNS allow third parties to register subdomains?

I have one of those questions that rely on the rule sets for DNS lookup. Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
0
votes
1answer
59 views

How do I know if I can trust a DNS service

How can I decide if I could trust a given DNS service as a user? For example I have just seen DNS-Watch which tells me that it is secure and that they don't log anything. How can I decide if the ...
0
votes
1answer
86 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
-2
votes
1answer
115 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
407 views

What are the possible solution for blocking VPN connection on a home network?

I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
4
votes
2answers
170 views

How can I prevent abuse of our public WiFi network?

One of our customers runs a holiday park with <100 users on it. We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been ...
6
votes
2answers
1k views

Strange Problem - DNS Cache Poisoning?

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home: About three times now in the past year, when I open some website - I'm thrown ...