Questions tagged [dns-spoofing]

DNS Spoofing is a network attack whereby data is introduced into a Domain Name System (DNS) resolver's cache by an attacker that has no authority, causing diverting injected names to redirect traffic to a host controlled by the attacker.

Filter by
Sorted by
Tagged with
8
votes
3answers
11k views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
1
vote
1answer
57 views

DNS spoofing over https [duplicate]

If a device sends a request to https://example.com and someone spoofs the DNS response to redirect the request to some malicious server. Would the attacker be able to modify the packets during the TLS ...
1
vote
1answer
600 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2
votes
1answer
346 views

ARP spoofing + DNS spoofing

To make a prank on a friend, and also for educational purposes, I am trying to hack a DNS server in my local network. I am using Windows. I used arpspoof from GitHub. Can someone please elaborate on ...
0
votes
1answer
330 views

How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]

Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
0
votes
0answers
27 views

How do you debug a dns spoof in ettercap?

I'm new to man in the middle attacks, and network security in general. I was able to get a dns spoof to work once on this unsecure website: http://www.stealmylogin.com/. The other times I`ve tried the ...
0
votes
1answer
160 views

DNS spoofing protection in Chrome and Firefox

I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
6
votes
2answers
9k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
1
vote
1answer
233 views

How to prevent from DNS spoofing in Java code which obtains a name of localhost

FORTIFY static scan has detected that this piece of our java code is vulnerable to DNS spoofing attack: public String getLocalhostName(){ try { return Inet4Address.getLocalHost()....
1
vote
1answer
70 views

What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
1
vote
1answer
173 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
1answer
49 views

Spoofed DNS answers ignored by target machine applications

Attacker: Arch Linux Target: Windows 10 Scenario The attackers launches an ARP spoof attack to redirect all target traffic to the attacker. (This works) The target sends DNS queries for domain name ...
-2
votes
2answers
66 views

Dns poisoning for any search [closed]

DNS poisoning works only if we open a certain website. For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page. What if we want to redirect the victim to 192....
1
vote
0answers
42 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
1answer
3k views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
29
votes
3answers
8k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
17
votes
4answers
8k views

DNSSec (Comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec. I've done a little research on DNSSec and its benefits. I ...
1
vote
2answers
97 views

The security of IP whitelisting large ranges

I am not a network expert but; a recent conversation has come up with a client asking to whitelist a range of ip's (let's say 250 odd for now) to transfer their data to us for processing. I should ...
0
votes
1answer
99 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
11
votes
2answers
3k views

dnsspoof not spoofing (requests and forwards real DNS packet)

I was trying to use dnsspoof but it did not work as expected. These are the steps I followed: Set IP forward in kernel to 1 arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
6
votes
2answers
4k views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
1
vote
2answers
521 views

VPN protection against DNS poisoning on AP

Does a VPN protect against a malicious DNS configuration on the Access Point? By my understanding it should, since traffic to the final destination should be encrypted and encapsulated inside packets ...
0
votes
2answers
6k views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
5
votes
2answers
189 views

With DNSSEC, is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSEC at val-id.com and getvalid.com Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
2
votes
0answers
824 views

DNS Packet Spoof Scapy

I am looking into local DNS spoofing by sniffing DNS-requests with Scapy, and sending a spoofed packet in response. Here is the code I used: from scapy.all import * def spoof_dns(pkt): if (DNS ...
1
vote
3answers
122 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
0
votes
2answers
613 views

Spam Russian Subdomains on my Website

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website As you can see ...
1
vote
2answers
107 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
2answers
666 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
1answer
162 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
1
vote
1answer
332 views

How does mitmf-filepwn implement dns-spoofing?

While running the following command in Kali mitmf -i eth0 --arp --spoof --gateway 192.168.1.1 --target 192.168.1.4 --filepwn i have noticed that in latest chrome, when i typed google.gr the result was ...
1
vote
1answer
108 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
61 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
0
votes
1answer
233 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
5
votes
2answers
23k views

Modify the hosts file of the router and redirect trafic

My question is how can I modify the hosts file of the router (If it exists), And redirect users to my server when they prompt a specific website?
1
vote
1answer
129 views

What are the ways to identify a DNS cache poisoning attack?

Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
2
votes
1answer
503 views

Certificates for localhost, MITM Attack

Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/ You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
0
votes
1answer
416 views

How to force users on my LAN to use a specific DNS server with arp poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
22
votes
5answers
7k views

Does DNS allow third parties to register subdomains?

I have one of those questions that rely on the rule sets for DNS lookup. Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
6
votes
2answers
1k views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
38
votes
4answers
7k views

How could a public DNS server return bad results?

I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people). In our country, YouTube, Twitter, Facebook and many other ...
6
votes
2answers
1k views

Strange Problem - DNS Cache Poisoning?

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home: About three times now in the past year, when I open some website - I'm thrown ...
1
vote
0answers
75 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
1answer
530 views

Bypassing HSTS and Public-key pinning with lookalike characters

Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack. Redirect: facebook.com --> faceḃook.com -- I have seen SSLStrip+ using the technique ...
2
votes
1answer
114 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
3
votes
0answers
2k views

dnsspoof and bettercap not dns-spoofing

I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
0
votes
1answer
2k views

Is IP spoofing possible in Windows Desktop with user privileges?

I read on WinSockAPI that IP spoofing is disabled for Desktop windows devices (non-servers like Windows 7, etc). However, I've been able to do IP spoofing using nmap, so clearly this is possible. ...
2
votes
0answers
308 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
7
votes
2answers
926 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
1
vote
0answers
58 views

Where are the DNS resolvers? [closed]

I'm trying to understand the principle behind DNS poisoning attacks. It seems like the DNS Resolver is just a piece of software. Where is this software located, and how is it shared among all the ...