Questions tagged [dns-spoofing]

DNS Spoofing is a network attack whereby data is introduced into a Domain Name System (DNS) resolver's cache by an attacker that has no authority, causing diverting injected names to redirect traffic to a host controlled by the attacker.

Filter by
Sorted by
Tagged with
1
vote
0answers
112 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...
0
votes
1answer
72 views

Would DNSSec and DANE be more secure if the same key was published to different TLDs?

Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs? For example: ...
11
votes
2answers
3k views

dnsspoof not spoofing (requests and forwards real DNS packet)

I was trying to use dnsspoof but it did not work as expected. These are the steps I followed: Set IP forward in kernel to 1 arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
14
votes
2answers
2k views

What problem does DNSSEC solve?

I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions ...
0
votes
2answers
253 views

DNS Spoof saves IP to Domain Name after attack is finished, Is there a way to stop this?

As I understand after a Domain Name is resolved to a specefic IP through DNS www.example.com resolves to 10.10.10.10, this cache is saved in RAM in a computer for a little bit, AKA five or so minutes. ...
4
votes
1answer
631 views

Stop DNSSpoof after login

Preface: I had an argument with a buddy the other day, he said it was impossible I disagreed. So say I have a large network of computers all visiting the same website for some reason. Then I have a ...
0
votes
1answer
1k views

DnsSpoof Target machine wont connect

SETUP: Target Machine: VM on my network, on a machine that is hardwired to the router Kali Box: Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both ...
0
votes
1answer
597 views

DC server integrated with DNS trying to contact Blacklisted DNS hostname

Need some help in understanding below attack. The below logs are extracted from the firewall and i could see a outbound connection from ldap server to 194.169.218.42. But walking through the logs(...
5
votes
2answers
23k views

Modify the hosts file of the router and redirect trafic

My question is how can I modify the hosts file of the router (If it exists), And redirect users to my server when they prompt a specific website?
0
votes
2answers
695 views

Why do SSL enabled sites don't reply back according to “hosts” file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
3
votes
1answer
4k views

Why does DNS Spoofing not working on HTTP ,HTTPS Sites? [in my case]

I am trying to perform a DNS spoofing attack, but the confusing thing is that when I'm performing the attack on HTTP sites, nothing happens. But when I perform it on HTTPS sites, when I reach the ...
1
vote
3answers
638 views

Does ARP or DNS spoofing play a role when performing MITM in fake AP attacks?

I have a test environment, where I try some wireless hacking tools and approaches, and lately I have been interested in evil twin attacks. I created a fake AP using airbase-ng, and specified the IP ...
1
vote
2answers
104 views

Strange apple dns answers

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59 I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like ...
7
votes
2answers
939 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
0
votes
2answers
1k views

What are the types of DNS spoofing?

I saw a post on here about how there are multiple types of DNS spoofing, it said: "DNS spoofing refers to the broad category of attacks that spoof DNS records. There are many different ways to do DNS ...
1
vote
1answer
333 views

How does mitmf-filepwn implement dns-spoofing?

While running the following command in Kali mitmf -i eth0 --arp --spoof --gateway 192.168.1.1 --target 192.168.1.4 --filepwn i have noticed that in latest chrome, when i typed google.gr the result was ...
6
votes
2answers
1k views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
2
votes
1answer
2k views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
2
votes
0answers
144 views

bind9 resolves all queries to one address - a compromised server?

Since this morning we tried to open some SSL sites and were greeted by browser warnings, that certificate is not for this site. Upon checking the certificate, we determined that it is issued to *....
4
votes
1answer
297 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
7
votes
2answers
4k views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
0
votes
1answer
280 views

apis.google.com has an invalid security certificate. How do I overcome this problem?

This is a screenshot of my browser when I tried visiting my public calendar. It shows that apis.google.com has an invalid security certificate: This means that there is some problem with my DNS right?...
4
votes
2answers
433 views

Amazon keeps asking for login/cc info via unsecure page - DNS hijack?

All my computers in the house will not connect to Amazon.com, but some unsecure (http) Amazon login page. This is the second time I'm having this issue. The first time I resolved it by changing my ...
-2
votes
1answer
4k views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
4
votes
1answer
1k views

Intercept DNS query packet and send spoofed response after ARP poisoning

On my network, I am able to perform ARP poisoning but only for a target machine not router. Therefore, I cannot spoof responses by intercepting router's packets and modifying them (http://...
-2
votes
1answer
244 views

My internet service provider spying on me?

I have found when I ping "www.google.com" the response is an ip address of my country location, not Google. The strange thing is the site opens normally. Anyone have an explanation?
8
votes
5answers
2k views

I don't recognise my DNS server's address: does this mean I am compromised?

I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address ...
1
vote
1answer
163 views

Is it feasible to use DNS query packets as a reflection tool in public WiFi environments?

It's common sense that DNS query packet can be used to establish convert channels. But in my experiment of DNS query reflection, where I send out DNS queries with spoofed source IP and MAC address to ...
1
vote
1answer
121 views

Domain sale - Is it DNS hijacking?

I am using a desktop that has two Linux distros and Windows 7 installed, and a laptop with same installation. Both of them are in my home network. And sometimes when I try to visit some websites such ...
2
votes
0answers
788 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
8
votes
3answers
12k views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
1
vote
1answer
255 views

Legal: ISP Compromised DNS [closed]

Background: A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving ...
20
votes
2answers
22k views

Why doesn't DNS spoofing work against HTTPS sites? [duplicate]

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.
3
votes
1answer
1k views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...
1
vote
1answer
3k views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
25
votes
5answers
8k views

How secure is binding to localhost in order to prevent remote connections?

Let's say we're running a service that's bound to localhost (127.0.0.1), and the goal is to only allow local clients (i.e. from the same machine only) What techniques might be used to break this ...
5
votes
2answers
190 views

With DNSSEC, is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSEC at val-id.com and getvalid.com Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
12
votes
2answers
2k views

When using https but not DNSSEC, under what situation, a client is vulnerable?

So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server. My question is that when protected by https, under what circumstances, a client is ...
1
vote
1answer
225 views

How does the DNS-spoofer know the original destination of the packet?

It's perhaps my lack of deeper knowledge of how the DNS, NAT or TCP works, but I have been thinking about the following scenario and can't figure out the following problem which arises in DNS-spoofing ...
3
votes
1answer
866 views

Is it possible to intercept traffic by using a WAN facing DHCP server on an ISPs cable network?

I am running pfSense on an edge firewall conncted to a cable line. I can see many DHCP requests hitting my firewall. I guess this requests are getting send by cable modems currently booting up and ...
3
votes
3answers
261 views

How to determine if resolved ip is rogue or part of CDN?

I'm subscribed to goverment's owned ISP because only this ISP provides access to rural area. It has a bad reputation because it is not only redirects sites, but also injects JavaScript for ...
9
votes
2answers
2k views

Is the Google address being spoofed on my computer?

I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed. I believe that a process has modified some network file on my computer, like ...
8
votes
4answers
1k views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when ...
3
votes
1answer
368 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
5
votes
1answer
1k views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
4
votes
2answers
3k views

DNS cache poisoning in LAN without MITM

Many questions have already been asked about DNS cache poisoning (aka Kaminsky attack), however I couldn't find a clear answer to my question: Is DNS cache poisoning possible in a LAN, without ...
7
votes
1answer
1k views

DSL Modem Compromised?

Just found out that the primary & secondary DNS servers have been changed to 95.211.156.101 & 5.45.75.11. I had the following setup in place. MAC filtering and WPA2 for WiFi. ...
5
votes
1answer
2k views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
4
votes
1answer
2k views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
1
vote
1answer
717 views

DNS queries to compromise DNS cache

The transaction ID for DNS queries can take values from 1 to 65,536 and my computer pseudorandomly chooses one for each DNS request. If I sents 1,024 false replies per request, how many requests ...