The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

0
votes
1answer
19 views

how to debug for DNS changing Maleware on (linux/android)?

So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I ...
2
votes
2answers
57 views

How can I search for registered domains, but not unregistered domains?

There are many many services available to "search for domain names", but every one I have found returns results for unregistered domains; whereas I would like to a wildcard search for registered ...
0
votes
0answers
13 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with ...
-3
votes
1answer
54 views

Assume an attacker has taken control of a lot of routers. How would the attacker use them to make a rogue DNS server? [closed]

What can hackers do exactly with hacked routers? I heard about hackers that compromise a lot of routers. I want to know how they have made a rogue DNS server? It's like DNS spoof over WAN. I want a ...
2
votes
2answers
53 views

Does a domain name ever leave my local system if the matching IP is defined in my hosts file?

Given the domain website.org and an a corresponding webserver with the IP 1.2.3.4. If a client defines the IP with the domain name in its host file like: $ cat /etc/hosts [...] 1.2.3.4 website....
22
votes
2answers
2k views

How does a website know the DNS server a client uses?

There are websites which claim to do "DNS leak tests". I don't care so much about DNS leaks but am curious, how does the website know which DNS server I am using? I guessed it would be a header sent ...
1
vote
2answers
20 views

Does the use of the non-registered domains in SPF records introduce a security risk?

Recently I was reading about the Sender Policy Framework (SPF) record syntax on OpenSPF.com. Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by ...
0
votes
1answer
76 views

Detecting DNS tunneling

I have been trying to detect/establish DNS tunneling. First of all I logged out of my user account of the captive portal. Findings: $ nslookup <somesite> // works fine $ ping <somesite> /...
0
votes
1answer
28 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
0
votes
0answers
13 views

DNSSEC ZSK compromisation (man-in-the-middle attack)

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup). When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
0
votes
1answer
70 views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
1
vote
3answers
37 views

Are two DNS MX records pointing to the same IP a availability risk (single point of failure)?

Are two DNS MX records pointing to the same IP a availability risk as in a single point of failure (SPOF)? Even if there are three DNS MX records in total for example: mx1.example.com 192.168.1.1 ...
2
votes
1answer
190 views

Should I worry about GitHub using IP addresses that are described as having an unknown host?

Today, I got a message while doing a git push, saying Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts. It seems as if it's consistent with ...
1
vote
1answer
64 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
0
votes
1answer
26 views

Do I need to use DNScrypt, or can I just set up DNS by myself? What's the point?

So I'm not a fan of having lots of software on my PC, and I was thinking: do I actually need to use DNSCrypt or can I just type in DNS address of one of those private DNS services which do not log ...
3
votes
1answer
69 views

Blind SQL Injection using OOB DNS Practical Sniffing Help

I was looking at Excellent Article from Defcon 15's which was Data retrieval over DNS during SQL Injection Attacks. (https://www.youtube.com/watch?v=iQDw0hK_eFw). In this the speaker demonstrated the ...
10
votes
2answers
159 views

Using Single Domain Name to Identify Multiple Servers Improves Security? (Google's use of 1e100.net)

Since 2009, Google has been using a single domain name to identify its servers across multiple products: Following standard industry practice, we make sure each IP address has a corresponding ...
-3
votes
1answer
59 views

How two identical domains work on Internet when they got signed from two different CA

Let's say A and B. Considering A and B are from same location. A went to the verisign and get signed for example.com B went to the godaddy.com and get signed for same domain(example.com) Now question ...
1
vote
1answer
34 views

Man in the middle with certificate signed by known CA and DNS spoofing can work?

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a ...
11
votes
7answers
450 views

Can I trust DNS servers?

If I use my own VPN and use third party DNS - can I trust it? For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
2
votes
0answers
793 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
19
votes
4answers
5k views

What stops someone from just redirecting a HTTPS connection to a HTTP version of the site?

Let's say someone does an ARP spoofing or DNS poisoning attack to redirect traffic to their own web server. If the real site has an SSL/TLS certificate, would that stop the hacker from redirecting let'...
9
votes
2answers
131 views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
2
votes
1answer
83 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. some-other-site.elsewhere....
0
votes
1answer
57 views

How do I protect myself when using a public network? [duplicate]

I'm in a hostel with plenty of software engineers. I want to make sure I have some protection. I quickly read about dnscrypt and some VPN solutions. What measures can I take to ensure my data ...
1
vote
1answer
43 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
1
vote
1answer
119 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
3
votes
1answer
45 views

What could you do with a PTR record of “localhost”?

In today's log summary from my SSH server, I found the following interesting entry: Illegal users from: 113.175.205.167 (localhost): 2 times Doing a DNS lookup on 113.175.205.167 does indeed ...
0
votes
1answer
50 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
2answers
100 views

Why does our network firewall drop netbios-ns packets?

In our local domain environment, we use Sophos UTM to protect our network. When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
0
votes
1answer
74 views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
0
votes
1answer
91 views

How does a DNS provider provide SSL?

I use CloudFlare as my DNS provider for my domain, and I learned that they provide SSL. I was confused as to how a DNS provider can provide SSL because my communications between the client and my ...
3
votes
1answer
59 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
3
votes
2answers
107 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
1
vote
2answers
46 views

Strange apple dns answers

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59 I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like ...
3
votes
1answer
123 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
3
votes
1answer
110 views

Is DNS leak really an issue?

I'm reading about DNS leak and what threat it can pose to VPN users, for instance, this question. But generally, there's tons of similar topics on the internet. But what are people afraid of? I just ...
3
votes
2answers
53 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
0
votes
0answers
29 views

Detecting Spamming activities of Botnets

Remarks Hello Everyone,thanks for being a nice platform for expressing Everyone's Doubts/Views. Problem Statement I want to detect spamming activity of botnets Background Information about ...
5
votes
2answers
147 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network https://stackoverflow.com/questions/616055/https-certificate-for-...
1
vote
3answers
138 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
0
votes
0answers
59 views

Do these DNS requests seem like Conficker/Torpig-like behaviour?

I'm at my wit's end on this one... I have been seeing weird traffic from an IP on a client's local network and I think the host is malicious. Looking at the traffic it is producing, is always ...
3
votes
1answer
52 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
0
votes
1answer
51 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
1
vote
3answers
137 views

Can a rogue DNS server see my passwords?

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my ...
2
votes
1answer
65 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
0
votes
1answer
29 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
3
votes
2answers
164 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
1
vote
1answer
45 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
-1
votes
2answers
130 views

How risky is to to use external DNS servers? [closed]

My infrastructure doesn't have an internal DNS server, so I just forward any DNS request to external DNS servers by iptables rules. I wonder how risk that can be, and how easy is it to spoof DNS or ...