Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
-1
votes
1answer
3k views

How do you encrypt DNS traffic in 2017? [closed]

I have seen a couple of questions on here today that recommend DNScrypt for encrypting DNS traffic. However, I feel a little bit of gut inertia that this is not good enough for 2017. What tools do ...
0
votes
1answer
783 views

Is SSL + DNScrypt enough to hide visited domains from my ISP?

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing ...
2
votes
2answers
192 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
0
votes
2answers
130 views

Should entire domains always be blacklisted?

I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...
1
vote
1answer
3k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
5
votes
2answers
336 views

what an attacker can do if he/she got access my router admin panel?

Today I found that anyone can access my router from outside my lan using my public ip. Then after some study, I came to know that the problem was not only with my router but it is a bsnl ...
1
vote
0answers
75 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
0
votes
3answers
357 views

How do I recognize or prevent using a malicious WiFi network?

Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests ...
4
votes
1answer
840 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
0
votes
1answer
393 views

DNS hijacking and Subject Alternative Names

My website is published on Google's Firebase Hosting. I own the domain. Google provision an SSL certificate (lately from Lets Encrypt, it used to be someone else). The certificate is shared between ...
4
votes
1answer
964 views

Can the real IP address leak using curl via Tor?

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org is as ...
2
votes
1answer
114 views

Does CVE-2017-9445 also effect Ubuntu 14.04.X and 16.04.X?

After all the buzz about CVE-2017-9445 it seems unclear to me which versions are really affected and need patching and which not? Their own CVE issue states that Ubuntu 14.04 to the latest upstream ...
2
votes
3answers
605 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
2
votes
0answers
514 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
3
votes
1answer
739 views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
0
votes
1answer
595 views

What are the privacy advantages of a DNS encryption service such as DNScrypt?

Privacy experts recommend dnscrypt (for example r/privacy). The only advantage of DNScrypt I can see is that it protects against an attacker sniffing my DNS traffic (I am using a VPN anyway) and man-...
1
vote
1answer
371 views

Perform man-in-the-middle attack on HTTPS website with same certificate [duplicate]

I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on ...
-1
votes
1answer
525 views

WannaCry DNS abilities

I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out? www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
4
votes
3answers
2k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
8
votes
1answer
1k views

How DNS is leaked? [duplicate]

I am newbie in network security. I cannot understand how can a server detect my DNS servers and how they can be useful to break anonymity. I understand how does the Internet work. How the request is ...
1
vote
1answer
488 views

Does SSL protect you from DNS attacks? [duplicate]

You can't use another website's certificate because when you replace the certificate's domain name with yours the certificate would become invalid (due to hashing). However, if you could make a user ...
0
votes
1answer
85 views

Intruder playing games with my home connection?

Was checking my home router and this appears in my logs just as I try to log in. The log shows system issues, and after my login which is the listed IP, there's a message of a 'DNS' query with a ...
1
vote
2answers
164 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
1
vote
1answer
380 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
1
vote
0answers
108 views

Strange DNS resoultion only on my laptop?

Here's a very strange thing I've noticed happening. At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix. In other words, I ...
-1
votes
1answer
442 views

Unknown website using my domain name [closed]

I own andchat.net which I've left dormant and should not lead to any website. My nameservers were pointing to ns1.linode.com and ns2.linode.com (my previous hosts). Today I just realized if I visit ...
2
votes
2answers
160 views

Securing servers in home network with https

Over time my home network accumulated quite some devices which run web interfaces. They are accessed only locally, from within the home network. What would be the best way to run them with https, ...
3
votes
3answers
2k views

DNS hijack redirect from one HTTPS hostname to another?

I just finished reading a Wired article about a DNS hijack where the attackers redirected all bank traffic to servers they hosted on Google Cloud. What I thought was interesting about the story is ...
5
votes
4answers
4k views

DNS MITM Attack

If you're in a public space (eg. airport, coffee shop) and and mistakenly connect to a rogue access point is it possible for them to intercept your DNS queries and replace them with ones that send you ...
3
votes
1answer
222 views

Inbound traffic from ISP's DNS server [closed]

My Symantec end point traffic logs keep showing that inbound UDP traffic from the DNS server is blocked. This happens every few minutes. Is it a potential attack?
4
votes
1answer
190 views

Without exaggeration, what are the practical security implications of the anti-privacy legislation S.J. Res. 34 for the average Internet user?

A resolution was passed in the US Senate today, that allows US ISP's to sell its users' "browsing data" and private information to third parties. If this resolution becomes a law, does this mean ...
2
votes
1answer
590 views

Is having an incorrect PTR record a security risk?

The Reverse DNS PTR-records (or Pointer Records, or Reverse Record) are often incorrect. Like pointing to: the domain of a hosting provider; a non-existing domain. Let's say I have example.com ...
2
votes
1answer
164 views

DNS sending queries to weird IP

I have noticed some strange activity on a dns server of mine and wanted to pick some brains. Every request being made to this dns server has an additional udp packet being sent to an ec2 IP address in ...
4
votes
1answer
2k views

DNS leak test shows that my ISP swaps google DNS for its own

I've tested DNS for a leak at dnsleaktest.com and I'm getting these results: When I'm not specifying DNS on my PC, it's using default ISP's DNS. When I change it to google's DNS: DNS leak test shows ...
1
vote
1answer
243 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
4
votes
1answer
786 views

How can I detect malicious activity based on patterns of DNS requests? [closed]

I want to know whether a client is infected by detecting malicious activity based on patterns of DNS requests. e.g.Suppose someone hacked google website and injected codes in it and when user clicks ...
2
votes
1answer
120 views

how to ensure that the DNS server is giving me the legitimate information?

if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and ...
2
votes
0answers
338 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
1
vote
2answers
106 views

How much privacy do domain whois privacy services really offer?

I have a domain with my real name, address and contact info on the whois record. I am considering purchasing a privacy service to hide these details. Will that actually help, given that my record is ...
0
votes
1answer
350 views

What are known domain hijacking methods?

The definition of domain hijacking is: "to gain (temporarily) control a domain" which could be either through: Stealing the legal and/or technical ownership of a domain (for example by transferring ...
1
vote
1answer
441 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
270 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
1
vote
1answer
225 views

How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]

Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
0
votes
0answers
327 views

DNS Server being Accessed by Internal and External Host

I came across of a situation in which I can see internal ip and external ip accessing a corporate dns server. I do not know if the dns server is internal dns or external dns. I have very limited ...
1
vote
0answers
107 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...
1
vote
1answer
73 views

Is there any point in activating domain privacy after the fact?

If I have a domain name that does not have privacy protection enabled, is there any point in enabling it now? Or is it useless once the information is out there? I'm asking this because I'm aware that ...
2
votes
2answers
215 views

Is this DNS reflection attack a DOS or DDOS attack?

I was asked this as a test question and I was wondering if I answered correctly. I was thinking this was a DOS attack because it came from one server not multiple. So can anyone tell me if this is ...
6
votes
1answer
917 views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
2
votes
1answer
110 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
2
votes
0answers
222 views

Non-logging openVPN DNS queries?

I have set up OpenVPN and BIND on a VPS and have a few questions regarding DNS resolving. I have configured bind to push 10.8.0.1 to my client and set the nameserver in resolv.conf to 127.0.0.1. The ...