Questions tagged [dns-domain]

A domain name is an identification string that defines a realm of administrative autonomy, authority, or control on the Internet. Domain names are formed by the rules and procedures of the Domain Name System (DNS). Technically, any name registered in the DNS is a domain name.

Filter by
Sorted by
Tagged with
0
votes
0answers
78 views

Gsuite compromised - changing DNS MX records to prevent attackers

We have lost access to Gsuite admin portal as the account has been compromised by phishing emails. Upon trying to recover the account, we can verify SMS sent to the number but the recovery email ...
0
votes
0answers
48 views

How does the Amass intel module correlate information?

Can someone explain to me how OWASP Amass correlates information regarding the intel module domain search? As an example, if I run the command: amass intel -d example.com -whois I'll get a list of ...
3
votes
2answers
91 views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
1
vote
0answers
68 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
1
vote
1answer
64 views

Is the _acme-challenge subdomain protected?

I was looking into the DNS-01 challenge of Let's Encrypt, and I had a question about the subdomain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to request ...
2
votes
1answer
102 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
134
votes
2answers
24k views

Why is “fhepfcelehfcepfffacacacacacacabn” a top DNS query from my devices?

I recently set up NextDNS on my personal devices to further reduce the amount of tracking and ads I'm exposed to. The service comes with built-in analytics that shows a brief overview of your network ...
0
votes
0answers
66 views

Can you use a domain to forward web traffic at DNS to another domain but still use the MX record for this domain

What I am attempting to do is ensure all ingress web traffic [http(s)] to exampledomain1.com forwards to exampledomain2.com but I still want to use the MX record of exampledomain1.com to point to at ...
2
votes
1answer
116 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
0
votes
1answer
97 views

Is the “same registrable domain” a sound security basis for cookies?

Unlike other Web standards, HTTP cookies don't use the common definition of the "origin" as with the "same origin policy"; cookies are segregated by domain names and subdomains. (And there is the ...
0
votes
0answers
75 views

Risks associated with developers using their own domain for development services

We have some development and test environments using our canonical domain, e.g. dev.example.com. We also use some services from 3rd party providers that have obscure URLs like xjkhasdkjvhas.dns.ashdfb....
0
votes
1answer
82 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
0
votes
0answers
29 views

How do I white list domain in ASG's?

I need to whitelist https://hooks.slack.com in Application Security Group (ASGs). As I have understood ASGs are static and they don't resolve DNS. Then how do I whitelist https://hooks.slack.com ...
0
votes
1answer
214 views

Securing DNS by blocking querys AND responses [Dnscrypt questions]

Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via ...
25
votes
3answers
8k views

Computer name naming convention for security

I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup). I would like to report this so that they use less ...
1
vote
0answers
375 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
3
votes
1answer
248 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
0
votes
1answer
61 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
1
vote
1answer
65 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
1
vote
2answers
143 views

Domain name vs IP only hosting?

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
0
votes
1answer
95 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
2
votes
0answers
72 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
-1
votes
1answer
36 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
2
votes
1answer
80 views

Can a domain name be trusted?

I'm in need of some distributed processing, the cheapest way for me to get that processing power is renting some dedicated servers from a company with specialized hardware for this. The servers that ...
1
vote
1answer
489 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
1
vote
1answer
80 views

Is there any security reason to prefer local IP address over zeroconf “.local” domain name?

I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" ...
1
vote
0answers
230 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
1
vote
1answer
231 views

Authoritative DNS server resolve also any other domain - Is that a risk?

In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites. However, I found that those ...
1
vote
0answers
67 views

How to tell if my hosting data is valid or a fake copy

I'm investigating an issue where we have consistent performance issues with our company web host and bad statistcs data in our hosting console. Our hosting provider console says our IP address is one ...
5
votes
1answer
1k views

Why some applications host the API in a different domain?

I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com). Two examples: 3.basecampapi.com and api.dropboxapi.com Is there a ...
1
vote
1answer
158 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
2answers
139 views

What is the rationale of binding SSL certificates to a domain name? [duplicate]

As I understand them, SSL certificates contain a domain name, a public key and the giving CA. Why is it important to include a domain name? Why isn't it enough that the CA considers the public key as ...
-3
votes
3answers
572 views

Why can I access a website using its domain name but I cannot when using its IP address directly? [closed]

For my target domain e.g. www.domain.com I find the ip address with ping command but if I browse directly the ip address I obtain an error page. How is it possible? I know that problably the service ...
-2
votes
1answer
268 views

Where is payload reside in a DNS frame when tunneling? [closed]

Can anyone explain me about DNS tunneling? where the TCP/IP packet or payload data injected in a DNS frame? How data get decapsulated in the server side? Explain DNS frame?
15
votes
4answers
3k views

Unauthorized domain comes up as my website [duplicate]

While checking my website's traffic, I found a referring website that had sent over 400 visits to my site. When I clicked on the URL of the referring website, the site looked almost exactly like my ...
-1
votes
3answers
83 views

Securing Domain Names for Resell [closed]

Is there any reason to why there cannot be a rule/law that prohibits the securing of domain names for resale? E.g A new acquired domain must have a running website within say 1 year or 6 months ...
1
vote
1answer
91 views

How are hackers able to plant Phishing URLs in existing websites? [closed]

As the question says, How are hackers able to plant Phishing URLs in existing websites? And can it be detected?
0
votes
1answer
91 views

How can I verify ownership of a domain

I'm working on a web service. I need a way to verify a user owns a domain they attempt to use in the service. How can I verify when a user attempts to add a domain to the service that they own the ...
6
votes
2answers
680 views

How can Cloudflare determine the owner of a website?

Assume that we have two websites with two different owners. Both of them set their domain name server to john.ns.cloudflare.com and joly.ns.cloudflare.com. The first owner set both domains in his ...
0
votes
2answers
186 views

Should entire domains always be blacklisted?

I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...
1
vote
0answers
79 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
4
votes
1answer
957 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
4
votes
3answers
3k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
1
vote
1answer
250 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
4
votes
0answers
165 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
1
vote
1answer
77 views

Is there any point in activating domain privacy after the fact?

If I have a domain name that does not have privacy protection enabled, is there any point in enabling it now? Or is it useless once the information is out there? I'm asking this because I'm aware that ...
6
votes
1answer
1k views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
4
votes
1answer
365 views

Cant access most websites using a fake AP created by aircrack-ng suite

The question , Setting up a fake AP - problem with iptables and DNS server , I posted before was answered and fixed, to not confuse people looking for the same problem in the future I wanted to post a ...
0
votes
1answer
58 views

Information security point of view when registering a domain and chosing a TLD

How much does the choice of the domain registrar and the TLD impact the security of my information? I've learned that some registrars will require more personal information than others. I even had a ...
2
votes
0answers
625 views

How can I check if a domain is malicious? [closed]

I have started to look for domain names inside my traffic. So I am interested to identify which one is malicious or doing some malicious acitivites. I know by looking at online web-services such as ...