Questions tagged [dns-spoofing]
DNS Spoofing is a network attack whereby data is introduced into a Domain Name System (DNS) resolver's cache by an attacker that has no authority, causing diverting injected names to redirect traffic to a host controlled by the attacker.
121
questions
8
votes
3answers
11k views
DNSspoof not working
My aim is to DNSspoof.
My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address.
I have enabled Kernel IP forward in Linux.
DNS host file ...
1
vote
1answer
57 views
DNS spoofing over https [duplicate]
If a device sends a request to https://example.com and someone spoofs the DNS response to redirect the request to some malicious server. Would the attacker be able to modify the packets during the TLS ...
1
vote
1answer
600 views
DNS Hijack: Only spoofing sites listed in etter.dns
I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2
votes
1answer
346 views
ARP spoofing + DNS spoofing
To make a prank on a friend, and also for educational purposes, I am trying to hack a DNS server in my local network. I am using Windows. I used arpspoof from GitHub.
Can someone please elaborate on ...
0
votes
1answer
330 views
How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]
Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
0
votes
0answers
27 views
How do you debug a dns spoof in ettercap?
I'm new to man in the middle attacks, and network security in general. I was able to get a dns spoof to work once on this unsecure website: http://www.stealmylogin.com/. The other times I`ve tried the ...
0
votes
1answer
160 views
DNS spoofing protection in Chrome and Firefox
I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
6
votes
2answers
9k views
Spoofing email From address
Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
1
vote
1answer
233 views
How to prevent from DNS spoofing in Java code which obtains a name of localhost
FORTIFY static scan has detected that this piece of our java code is vulnerable to DNS spoofing attack:
public String getLocalhostName(){
try {
return Inet4Address.getLocalHost()....
1
vote
1answer
70 views
What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?
I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
1
vote
1answer
173 views
DNSSEC - does the domain owner owns a key?
The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
1answer
49 views
Spoofed DNS answers ignored by target machine applications
Attacker: Arch Linux
Target: Windows 10
Scenario
The attackers launches an ARP spoof attack to redirect all target traffic to the attacker. (This works)
The target sends DNS queries for domain name ...
-2
votes
2answers
66 views
Dns poisoning for any search [closed]
DNS poisoning works only if we open a certain website.
For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page.
What if we want to redirect the victim to 192....
1
vote
0answers
42 views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
1answer
3k views
Does MITM attack work across Remote Systems?
I have question about if MITM works across remote systems?
Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network.
Does classic ...
29
votes
3answers
8k views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
17
votes
4answers
8k views
DNSSec (Comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.
I've done a little research on DNSSec and its benefits. I ...
1
vote
2answers
97 views
The security of IP whitelisting large ranges
I am not a network expert but; a recent conversation has come up with a client asking to whitelist a range of ip's (let's say 250 odd for now) to transfer their data to us for processing.
I should ...
0
votes
1answer
99 views
DNS Spoof Adware
Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
11
votes
2answers
3k views
dnsspoof not spoofing (requests and forwards real DNS packet)
I was trying to use dnsspoof but it did not work as expected. These are the steps I followed:
Set IP forward in kernel to 1
arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
6
votes
2answers
4k views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
1
vote
2answers
521 views
VPN protection against DNS poisoning on AP
Does a VPN protect against a malicious DNS configuration on the Access Point?
By my understanding it should, since traffic to the final destination should be encrypted and encapsulated inside packets ...
0
votes
2answers
6k views
What is the most secure way to store cross subdomain cookies
I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
5
votes
2answers
189 views
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com
Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
2
votes
0answers
824 views
DNS Packet Spoof Scapy
I am looking into local DNS spoofing by sniffing DNS-requests with Scapy, and sending a spoofed packet in response.
Here is the code I used:
from scapy.all import *
def spoof_dns(pkt):
if (DNS ...
1
vote
3answers
122 views
Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?
I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
0
votes
2answers
613 views
Spam Russian Subdomains on my Website
I have the EXACT same problem that was addressed in a former thread on Stack Exchange here:
https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website
As you can see ...
1
vote
2answers
107 views
Can I alter the DNS cache on my Computer?
Can I alter the DNS cache of my computer.
When I search online it only shows result to flush DNS cache and not how to alter it.
The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
2answers
666 views
How to conduct this MITM attack [duplicate]
For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is:
1) The client request aaa.com
2) The MITM changes the client request to bbb.com
3) The ...
0
votes
1answer
162 views
How to implement an active Man-In-The-Middle attack that changes the request URL address
For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack.
The attack scenario that I want to do is a toy example (which has countermeasures ...
1
vote
1answer
332 views
How does mitmf-filepwn implement dns-spoofing?
While running the following command in Kali mitmf -i eth0 --arp --spoof --gateway 192.168.1.1 --target 192.168.1.4 --filepwn i have noticed that in latest chrome, when i typed google.gr the result was ...
1
vote
1answer
108 views
Work internet redirecting to Twitch?
When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel.
I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
61 views
DNS cache poisoining prevention by directly using ip instead of url
My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original).
So If I entered ...
0
votes
1answer
233 views
DNS Spoofing Detection with JavaScript
I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon?
Scenario:
Edit: wrong scenario was ...
5
votes
2answers
23k views
Modify the hosts file of the router and redirect trafic
My question is how can I modify the hosts file of the router (If it exists), And redirect users to my server when they prompt a specific website?
1
vote
1answer
129 views
What are the ways to identify a DNS cache poisoning attack?
Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
2
votes
1answer
503 views
Certificates for localhost, MITM Attack
Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/
You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
0
votes
1answer
416 views
How to force users on my LAN to use a specific DNS server with arp poisoning?
I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems.
I've had problems in the past trying to configure my router's ...
22
votes
5answers
7k views
Does DNS allow third parties to register subdomains?
I have one of those questions that rely on the rule sets for DNS lookup.
Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
6
votes
2answers
1k views
Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP
I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers.
Most questions I see here about man-...
38
votes
4answers
7k views
How could a public DNS server return bad results?
I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).
In our country, YouTube, Twitter, Facebook and many other ...
6
votes
2answers
1k views
Strange Problem - DNS Cache Poisoning?
I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home:
About three times now in the past year, when I open some website - I'm thrown ...
1
vote
0answers
75 views
How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?
This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
1answer
530 views
Bypassing HSTS and Public-key pinning with lookalike characters
Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack.
Redirect: facebook.com --> faceḃook.com
--
I have seen SSLStrip+ using the technique ...
2
votes
1answer
114 views
To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?
My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
3
votes
0answers
2k views
dnsspoof and bettercap not dns-spoofing
I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
0
votes
1answer
2k views
Is IP spoofing possible in Windows Desktop with user privileges?
I read on WinSockAPI that IP spoofing is disabled for Desktop windows devices (non-servers like Windows 7, etc). However, I've been able to do IP spoofing using nmap, so clearly this is possible. ...
2
votes
0answers
308 views
Mitigating reverse DNS lookup danger / exploitation
I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit.
However, ...
7
votes
2answers
926 views
Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?
Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
1
vote
0answers
58 views
Where are the DNS resolvers? [closed]
I'm trying to understand the principle behind DNS poisoning attacks. It seems like the DNS Resolver is just a piece of software. Where is this software located, and how is it shared among all the ...
