Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

DNS Spoof Printer on network

I was wondering if it would be possible to arp spoof my printer and router arpspoof -t printer router arpspoof -t router printer and then reroute all print requests to my CUPS print server on ...
0
votes
0answers
29 views

Is there an alternative to HPKP for dyndns?

For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can ...
1
vote
1answer
60 views

Does a searchable public database exist of (hostname; ip) mappings?

This question is not about the trivial usage of the forward/reverse DNS. Getting the IP of a hostname is trivial (DNS), and using reverse DNS, also we can get (typically) a single hostname of an IP. ...
0
votes
2answers
102 views

Websites that test what IPv6 DNS server I'm using? [on hold]

I am concerned with DNS hijacking when connected to a DNS server with an IPv6 address. Is there a website that tests what IPv6 DNS server I'm using? By "IPv6 DNS server" I do not mean IPv4 DNS ...
0
votes
1answer
62 views

nmap: Same IP, different domain names, different results?

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
0
votes
0answers
22 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
2
votes
1answer
93 views

Does a CAA record on a local hostname in a LAN offer additional security?

A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap....
0
votes
1answer
63 views

How does DoH protect against ISP tracking?

Seems like a modern ISP would already be equipped with some basic level of packet inspection to identify outgoing TCP connections even if just for doing traffic shaping or carrier-grade NAT, and ...
0
votes
0answers
27 views

How do I white list domain in ASG's?

I need to whitelist https://hooks.slack.com in Application Security Group (ASGs). As I have understood ASGs are static and they don't resolve DNS. Then how do I whitelist https://hooks.slack.com ...
0
votes
0answers
47 views

DNS and sometimes TCP packet are being sent out upon disconnecting and connecting wifi connection [closed]

I am monitoring my network interface and noticed that I can reproduce a behavior where some cryptic DNS packets are being sent out as well as TCP sometimes, without me opening any browser or ...
1
vote
0answers
19 views

OpenVPN drops connection about once a day, logs indicate DNS failure [migrated]

I have an old version of pfSense (2.3.2) running an OpenVPN client to a commercial server. Over the past few years, the OpenVPN connection has been dropping more frequently, and now it's about once ...
12
votes
3answers
3k views

Is a global DNS record a security risk for phpMyAdmin?

Services like phpMyadmin needs a domain name to access. Instead of adding a global DNS record, one could make a local DNS record (e.g. in /etc/hosts) to access the site. Would it increase security if ...
2
votes
1answer
44 views

Jump box DNS in the public

We have a jump box that allows people to connect via SSH into the system. Would it be a security concern by adding a public DNS entry that points to the jump box? (Would this not be security through ...
23
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
2
votes
0answers
81 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
0
votes
1answer
83 views

Should current DNS servers respond to obsolete DNS records? [closed]

Here is a list of obsolete DNS record types. Should I restrict my DNS server to not respond to these query types? Why are current public DNS servers responding to these query types?
0
votes
0answers
47 views

Why am I seeing SSL events resolve to OpenDNS IPs?

This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to 146.112.255.155 146.112.250.83 146.112.250.64 146.112.250.87 146....
0
votes
1answer
71 views

Securing DNS by blocking querys AND responses [Dnscrypt questions]

Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via ...
2
votes
2answers
206 views

Does changing DNS help prevent MITM on ISP level?

A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
1
vote
0answers
170 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
0
votes
0answers
50 views

Why is the attacker allowed to create DNS traffic in a DNS cache poison attack?

According to this article, a DNS cache poisoning attack is performed the following way: Send a large number of resolution requests each spoofed with different source IP information for www....
1
vote
1answer
66 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
0
votes
0answers
107 views

How to respond domain fluxing happening on workstations

A few workstations have been making dns requests to what looks to be DGA domains and talked to the security appliance vendor with little help. A vendor technician told me that some Apple servers ...
0
votes
1answer
344 views

Level 3 DNS default response for invalid host names

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.). For work I use a company VPN. On ...
0
votes
1answer
326 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
2
votes
1answer
109 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
2
votes
3answers
105 views

What happen when a local device have the same IP as an external website

When I enter 'google.com' in my web browser, my computer goes to the DNS server and gets Google's server IP address, then it look for that address in the local network and when it doesn't find it it ...
0
votes
1answer
240 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
-1
votes
1answer
56 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
1
vote
2answers
76 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
1answer
57 views

Data retrieved from DNSDB [closed]

I queried amazon.com using lookup API from DNSDB "https://api.dnsdb.info/lookup/rdata/name/amazon.com" and i got following response. qlightingcontrol.in. IN NS amazon.com. qlightingcontrol.com.tw. ...
1
vote
0answers
57 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
0
votes
2answers
154 views

Spam Russian Subdomains on my Website

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website As you can see ...
1
vote
1answer
120 views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
0
votes
0answers
63 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
0
votes
1answer
98 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
0
votes
0answers
111 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
1
vote
0answers
109 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
0
votes
0answers
76 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
1
vote
1answer
101 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
-2
votes
2answers
205 views

how does DNS cache snooping work?

I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using. Also, from what ...
0
votes
1answer
53 views

Are those animated video thumbnails generate the same DNS from actual videos?

I have a very technical question about the latest feature shown on those video platforms, like YouTube and other. There’s been a trend lately that the classic still image thumbnails have been ...
0
votes
1answer
58 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
1
vote
3answers
86 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
1
vote
1answer
55 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
0
votes
1answer
79 views

How to direct devices by hacking a router changing the DNS settings?

If I hacked a router's admin panel outside my network, is it possible to direct all devices in that network to any website I want by DNS settings? If it is possible, how?
2
votes
1answer
85 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
1
vote
1answer
121 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
3
votes
2answers
2k views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
0
votes
1answer
80 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...