Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

69
votes
5answers
14k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
30
votes
9answers
9k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
14
votes
2answers
3k views

How can I stop someone from displaying my website on his domain?

I just discovered that someone is pointing their domain name to the server I use for a website, which results in traffic to their domain displaying the content of my website. How can I stop this ...
24
votes
2answers
7k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
8
votes
3answers
40k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
27
votes
2answers
63k views

DNS zone transfer attack

Can anyone explain what is DNS zone transfer attack or give any link, paper? I have already googled, but could not find anything meaningful.
5
votes
2answers
2k views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
36
votes
5answers
155k views

If I use a VPN, who will resolve my DNS requests?

Will they be resolved by my VPN provider, or by my original ISP (if left on "automatic" settings)? Would I have to manually configure a dns server, to make sure my requests will not be resolved by my ...
52
votes
5answers
44k views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network https://stackoverflow.com/questions/616055/https-certificate-for-...
8
votes
1answer
2k views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
11
votes
1answer
22k views

DNS Spoofing vs DNS Cache Poisoning

What is the difference between DNS Spoofing and DNS Cache Poisoning ??? It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the "...
6
votes
3answers
1k views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
35
votes
8answers
45k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
37
votes
4answers
16k views

How can changing your DNS protect your online privacy?

Looking at a Unblock-US Features (a DNS provider) on their website it states the following: Stay out of the radar of prying eyes. With Unblock-us, you’ll have peace of mind knowing that your ...
20
votes
4answers
7k views

What stops someone from just redirecting a HTTPS connection to a HTTP version of the site?

Let's say someone does an ARP spoofing or DNS poisoning attack to redirect traffic to their own web server. If the real site has an SSL/TLS certificate, would that stop the hacker from redirecting let'...
17
votes
7answers
2k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the former....
16
votes
3answers
11k views

How can someone sinkhole domains?

The Wikipedia article about CryptoLocker says: In late-October 2013, security vendor Kaspersky Labs reported that with the help of a researcher, it had created a DNS sinkhole to block some of the ...
9
votes
1answer
22k views

dns reflection attack vs dns amplification attack

Over the past few weeks I have heard discussions about a DNS reflection attack and a DNS amplification attack. Is there truly a difference between the two or are people just using 2 different names ...
13
votes
2answers
3k views

How does dnsleaktest.com find my DNS provider

Can't see how they find this over the web. I'm on Windows, its in my network config. It changes when I use a VPN provider, but not when I use a local socks proxy connected to a remote server over ...
6
votes
3answers
5k views

Does DNS pinning protect against all DNS rebinding attacks?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers". Figure 1: An example of a dynamic pharming attack ...
6
votes
2answers
11k views

What can my ISP see in their log files if I use Google DNS?

For example, if I use my ISP DNS and open this page they will see: https://security.stackexchange.com/questions/ask It would show up in their logs for sure. But if I use Google DNS, then what ...
8
votes
2answers
7k views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
7
votes
2answers
2k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
6
votes
1answer
807 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
5
votes
1answer
976 views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
5
votes
1answer
696 views

DNS Flood using DNS Amplification?

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think). Based on recent events (the attack to Dyn's DNS service) I was ...
4
votes
2answers
1k views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
1answer
3k views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
1
vote
1answer
2k views

DNS leak with proxychains and firefox

When using firefox with proxychains - (default configuration file with tor: socks4 127.0.0.1 9050) and checking on dnsleaktest.com, the original lookup returns the proxied IP, but when performing ...
138
votes
3answers
26k views

Did I just get DNS Hijacked?

I went online on my Macbook today and noticed my iTunes complaining that it couldn't connect to Apple, I tried logging out and in of my account but weirdly it said it couldn't log in; I didn't think ...
17
votes
4answers
8k views

DNSSec (Comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec. I've done a little research on DNSSec and its benefits. I ...
25
votes
2answers
4k views

How does a website know the DNS server a client uses?

There are websites which claim to do "DNS leak tests". I don't care so much about DNS leaks but am curious, how does the website know which DNS server I am using? I guessed it would be a header sent ...
18
votes
3answers
10k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
25
votes
3answers
1k views

What are some risks of purchasing a “used” domain name

If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
8
votes
2answers
3k views

Dnscrypt vs Dnscurve?

Which is better for highest privacy and security ? I've read both of them and i still don't understand the differences between them... Can anyone explain what features is exclusive to one? My most ...
15
votes
3answers
2k views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
9
votes
2answers
960 views

How can I protect myself against DNS leaks?

As discussed here, a DNS leak is where DNS lookups ignore your current routing (in the example of a VPN connection) and still end up going out over your normal internet connection. This can ...
17
votes
1answer
1k views

Why don't browsers check CAA records to help ensure a certificate is valid?

If I understand correctly, Certification Authority Authorization DNS records are used to specify which certificate authorities are allowed to issue certificates for a given domain. If that record ...
15
votes
2answers
5k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
11
votes
2answers
655 views

How to protect and detect DNS manipulations from browser side?

After reading the question about a manipulated google analytics script I wonder how you would protect against this kind of attack. What comes to mind is setting DNS IP fixed in network configuration ...
6
votes
4answers
3k views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
5
votes
1answer
672 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack work? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
14
votes
3answers
1k views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
11
votes
2answers
4k views

How does DigitalOcean DNS verify the owner of a domain?

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean. DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. ...
10
votes
2answers
3k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
9
votes
1answer
5k views

Should I worry about GitHub using IP addresses that are described as having an unknown host?

Today, I got a message while doing a git push, saying Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts. It seems as if it's consistent with ...
7
votes
3answers
4k views

What's involved in taking over someone else's domain name?

I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
6
votes
2answers
21k views

Listing of DNS vulnerabilities

I am currently studying how to setup DNS servers and all aspects of the DNS system. I would also like to study the security aspect. I want to use current DNS server attack on my test servers. Is there ...
6
votes
3answers
5k views

Security risk with using internal IP on public DNS

A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP. Publicly, company.com nameservers belong to their ...
4
votes
2answers
214 views

Why would attacking a DNS server have the affects it did?

I'm somewhat confused as to the technical details of the Oct. 21 DDoS. Dyn is a company, which according to wikipedia is an Internet performance management company, offering products to monitor, ...