Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

0
votes
2answers
138 views

Spam Russian Subdomains on my Website

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website As you can see ...
6
votes
1answer
840 views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
1
vote
1answer
93 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
0
votes
1answer
57 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
1
vote
1answer
118 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
1
vote
0answers
89 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
1
vote
0answers
34 views

An unknown domain serving contents of my sites [migrated]

I found that an unknown domain like www.aaa.com serving exactly the same contents (html, js ,css, any asset) of my site: myname.me. And the API as well, for example, www.aaa.com/api/user get the ...
0
votes
0answers
46 views

Why is the attacker allowed to create DNS traffic in a DNS cache poison attack?

According to this article, a DNS cache poisoning attack is performed the following way: Send a large number of resolution requests each spoofed with different source IP information for www....
0
votes
1answer
66 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
3
votes
2answers
2k views

How to hide dns requests from ISP?

I am using google image a lot. I discovered through Wireshark, any images under preview mode of google images search result actually expose the dns where that image was hosted from. For example, my ...
0
votes
1answer
74 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
0answers
40 views

How to respond domain fluxing happening on workstations

A few workstations have been making dns requests to what looks to be DGA domains and talked to the security appliance vendor with little help. A vendor technician told me that some Apple servers ...
0
votes
1answer
105 views

Level 3 DNS default response for invalid host names

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.). For work I use a company VPN. On ...
0
votes
1answer
61 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
2
votes
1answer
98 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
51
votes
5answers
44k views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network https://stackoverflow.com/questions/616055/https-certificate-for-...
2
votes
3answers
101 views

What happen when a local device have the same IP as an external website

When I enter 'google.com' in my web browser, my computer goes to the DNS server and gets Google's server IP address, then it look for that address in the local network and when it doesn't find it it ...
0
votes
1answer
89 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
-1
votes
1answer
42 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
1
vote
2answers
73 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
1
vote
1answer
569 views

What are the possible solution for blocking VPN connection on a home network?

I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
0
votes
1answer
51 views

Data retrieved from DNSDB [closed]

I queried amazon.com using lookup API from DNSDB "https://api.dnsdb.info/lookup/rdata/name/amazon.com" and i got following response. qlightingcontrol.in. IN NS amazon.com. qlightingcontrol.com.tw. ...
1
vote
0answers
55 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
1
vote
1answer
71 views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
0
votes
0answers
44 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
1
vote
1answer
123 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
1answer
56 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
1
vote
1answer
214 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
1
vote
2answers
61 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
0
votes
0answers
95 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
1
vote
0answers
72 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
-2
votes
2answers
139 views

how does DNS cache snooping work?

I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using. Also, from what ...
1
vote
4answers
2k views

1.1.1.1 Cloudflare encrypted DNS.Does it still leak IP addresses?

1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its ...
0
votes
0answers
65 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
1
vote
1answer
89 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
50 views

Are those animated video thumbnails generate the same DNS from actual videos?

I have a very technical question about the latest feature shown on those video platforms, like YouTube and other. There’s been a trend lately that the classic still image thumbnails have been ...
0
votes
1answer
57 views

DNS cache poisoining prevention by directly using ip instead of url

My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original). So If I entered ...
2
votes
0answers
218 views

Non-logging openVPN DNS queries?

I have set up OpenVPN and BIND on a VPS and have a few questions regarding DNS resolving. I have configured bind to push 10.8.0.1 to my client and set the nameserver in resolv.conf to 127.0.0.1. The ...
1
vote
1answer
149 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
3
votes
2answers
14k views

Modify the hosts file of the router and redirect trafic

My question is how can I modify the hosts file of the router (If it exists), And redirect users to my server when they prompt a specific website?
13
votes
2answers
2k views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
1
vote
1answer
53 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
2
votes
1answer
864 views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
0
votes
1answer
56 views

How to direct devices by hacking a router changing the DNS settings?

If I hacked a router's admin panel outside my network, is it possible to direct all devices in that network to any website I want by DNS settings? If it is possible, how?
30
votes
9answers
9k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
2
votes
1answer
114 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
2
votes
1answer
70 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
35
votes
8answers
45k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
2
votes
2answers
1k views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
4
votes
1answer
85 views

Why does majority of the publicly routable IPs seem to have no rDNS assigned?

I built a Hilbert curve showing which IP addresses have rDNS assigned, based on one of the rDNS scan snapshots available on scans.io. I ended up getting the following (white means "assigned"): Is ...