Questions tagged [dns-spoofing]

DNS Spoofing is a network attack whereby data is introduced into a Domain Name System (DNS) resolver's cache by an attacker that has no authority, causing diverting injected names to redirect traffic to a host controlled by the attacker.

Filter by
Sorted by
Tagged with
0
votes
1answer
52 views

DNS spoofing protection in Chrome and Firefox

I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
1
vote
1answer
64 views

How to prevent from DNS spoofing in Java code which obtains a name of localhost

FORTIFY static scan has detected that this piece of our java code is vulnerable to DNS spoofing attack: public String getLocalhostName(){ try { return Inet4Address.getLocalHost()....
0
votes
1answer
36 views

Spoofed DNS answers ignored by target machine applications

Attacker: Arch Linux Target: Windows 10 Scenario The attackers launches an ARP spoof attack to redirect all target traffic to the attacker. (This works) The target sends DNS queries for domain name ...
-2
votes
2answers
61 views

Dns poisoning for any search [closed]

DNS poisoning works only if we open a certain website. For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page. What if we want to redirect the victim to 192....
1
vote
0answers
38 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
1answer
63 views

What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
1
vote
2answers
68 views

The security of IP whitelisting large ranges

I am not a network expert but; a recent conversation has come up with a client asking to whitelist a range of ip's (let's say 250 odd for now) to transfer their data to us for processing. I should ...
0
votes
0answers
289 views

Bettercap DNS and ARP spoofing only denies access to website

I recently have been using Bettercap and have been trying to use the dns spoof feature to redirect websites to my Apache server which has a beef hook embedded. It is very simple theoretically, but ...
0
votes
0answers
56 views

DNS Spoof Printer on network

I was wondering if it would be possible to arp spoof my printer and router arpspoof -t printer router arpspoof -t router printer and then reroute all print requests to my CUPS print server on ...
0
votes
1answer
196 views

ARP spoofing + DNS spoofing

To make a prank on a friend, and also for educational purposes, I am trying to hack a DNS server in my local network. I am using Windows. I used arpspoof from GitHub. Can someone please elaborate on ...
1
vote
0answers
581 views

DNS Packet Spoof Scapy

I am looking into local DNS spoofing by sniffing DNS-requests with Scapy, and sending a spoofed packet in response. Here is the code I used: from scapy.all import * def spoof_dns(pkt): if (DNS ...
0
votes
2answers
2k views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
1
vote
2answers
98 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
2answers
429 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
1answer
139 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
0
votes
2answers
591 views

Spam Russian Subdomains on my Website

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website As you can see ...
1
vote
1answer
106 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
95 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
0
votes
1answer
61 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
0
votes
1answer
175 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
1
vote
3answers
107 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
1
vote
1answer
122 views

What are the ways to identify a DNS cache poisoning attack?

Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
2
votes
1answer
412 views

Certificates for localhost, MITM Attack

Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/ You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
1
vote
1answer
534 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
0
votes
1answer
356 views

How to force users on my LAN to use a specific DNS server with arp poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
21
votes
5answers
6k views

Does DNS allow third parties to register subdomains?

I have one of those questions that rely on the rule sets for DNS lookup. Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
6
votes
2answers
1k views

Strange Problem - DNS Cache Poisoning?

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home: About three times now in the past year, when I open some website - I'm thrown ...
38
votes
4answers
7k views

How could a public DNS server return bad results?

I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people). In our country, YouTube, Twitter, Facebook and many other ...
1
vote
0answers
73 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
2answers
477 views

VPN protection against DNS poisoning on AP

Does a VPN protect against a malicious DNS configuration on the Access Point? By my understanding it should, since traffic to the final destination should be encrypted and encapsulated inside packets ...
1
vote
1answer
429 views

Bypassing HSTS and Public-key pinning with lookalike characters

Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack. Redirect: facebook.com --> faceḃook.com -- I have seen SSLStrip+ using the technique ...
2
votes
1answer
113 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
1
vote
1answer
155 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
3
votes
0answers
2k views

dnsspoof and bettercap not dns-spoofing

I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
0
votes
1answer
1k views

Is IP spoofing possible in Windows Desktop with user privileges?

I read on WinSockAPI that IP spoofing is disabled for Desktop windows devices (non-servers like Windows 7, etc). However, I've been able to do IP spoofing using nmap, so clearly this is possible. ...
2
votes
0answers
296 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
1
vote
0answers
57 views

Where are the DNS resolvers? [closed]

I'm trying to understand the principle behind DNS poisoning attacks. It seems like the DNS Resolver is just a piece of software. Where is this software located, and how is it shared among all the ...
2
votes
2answers
286 views

Active Directory DNS server security misconfiguration or an acceptable practice?

I work for a large Eastern European bank as a programmer. Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best ...
2
votes
0answers
83 views

DNS sinkhole usability

Although I know what the use of a DNS sinkhole is (I guess I do) I'm struggling to understanding how well scalable such solution is. DNS sinkhole or black hole DNS is used to spoof DNS servers to ...
2
votes
1answer
168 views

DNS spoofing+firewall port hijack/redirect to capture HTTPS requests without getting “certificate untrusted error” on the client browser [duplicate]

If i could setup a DNS server that responds with my server's IP for a certain domain, along with redirecting https and all DNS queries requests to my local https site and my local DNS server ...
0
votes
1answer
611 views

How to make dnsspoof work for https sites?

I tried to dnsspoof the victim machine for say "www.imdb.com" (with the help of setoolkit and ettercap). But the site is ssl https, so I read here that dnsspoof won't work for https sites. As quoted ...
0
votes
2answers
487 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
2
votes
2answers
198 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
0
votes
3answers
390 views

How do I recognize or prevent using a malicious WiFi network?

Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests ...
2
votes
3answers
609 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
0
votes
0answers
124 views

DNS hijacking to infect computers with ransomware?

While speaking to a friend regarding protecting personal computers from ransomware, I mentioned that I use a limited user account with application white-listing via SRP (I am running Windows). He ...
0
votes
1answer
787 views

MITM attack DNS spoofing problem [closed]

I’ve tried to DNS spoof dnsspoof -i eth0 -f spoofhosts.txt (inside spoofhosts.txt there is my (the attacker) local ip and the domain which i want to poison) and I just keep receiving this: ...
3
votes
3answers
2k views

DNS hijack redirect from one HTTPS hostname to another?

I just finished reading a Wired article about a DNS hijack where the attackers redirected all bank traffic to servers they hosted on Google Cloud. What I thought was interesting about the story is ...
0
votes
1answer
326 views

Is my DNS being poisoned?

Today I was greeted by this error in Firefox: It was happening consistently for a minute or two, and reverted back to normal. I confirmed that it happens on another browser and that other HTTPS sites ...
1
vote
0answers
111 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...