Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

64 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
767 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
Lieven Keersmaekers's user avatar
4 votes
0 answers
1k views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
MikeSchem's user avatar
  • 2,351
4 votes
0 answers
4k views

dnsspoof and bettercap not dns-spoofing

I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
Amy Jian's user avatar
3 votes
1 answer
470 views

Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?

I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia. On the subject of DNS cache poisoning, they mention that a "...
Stefan van den Akker's user avatar
3 votes
0 answers
97 views

Can some combinations of DNS-entries be security vulnerabilities?

Lets assume you have these DNS-entries for domain.tld: host = domain.tld type = SOA mname = dns.otherdomain.tld rname = hostmaster.otherdomain.tld host = domain.tld type = NS target = ns1....
Hubert Schölnast's user avatar
2 votes
0 answers
434 views

All private subdomains found and listed, including those from my home IP

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
Nuno's user avatar
  • 215
2 votes
0 answers
143 views

DNS Cache Poisoning With Multiple Requests

I am trying to understand this DNS cache poisoning from a textbook. Is it the case that the server does not check any pending requests for a given domain and will send all of the n "same" ...
Axo's user avatar
  • 21
2 votes
0 answers
925 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
None_None's user avatar
2 votes
0 answers
174 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
Js Lim's user avatar
  • 121
2 votes
0 answers
166 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
Miguel.G's user avatar
  • 121
2 votes
0 answers
117 views

DNS search lists cause ambiguity, but what are practical examples of this?

Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
sourcejedi's user avatar
2 votes
0 answers
625 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
Muradin007's user avatar
2 votes
0 answers
983 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
Jjang's user avatar
  • 121
2 votes
0 answers
509 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
Mark's user avatar
  • 235
2 votes
0 answers
342 views

Non-logging openVPN DNS queries?

I have set up OpenVPN and BIND on a VPS and have a few questions regarding DNS resolving. I have configured bind to push 10.8.0.1 to my client and set the nameserver in resolv.conf to 127.0.0.1. The ...
PjMpire's user avatar
  • 21
2 votes
0 answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
dotslash's user avatar
  • 387
2 votes
0 answers
233 views

bind9 resolves all queries to one address - a compromised server?

Since this morning we tried to open some SSL sites and were greeted by browser warnings, that certificate is not for this site. Upon checking the certificate, we determined that it is issued to *....
Kitet's user avatar
  • 179
1 vote
1 answer
125 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
1 vote
0 answers
89 views

Opencart website getting request from random subdomains (DDoS)

We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
Sankalp Chari's user avatar
1 vote
0 answers
224 views

Is iCloud Private Relay leaking my DNS queries to my ISP?

So I noticed recently that despite iOS settings saying all DNS queries go through iCloud Private Relay's DNS servers, despite Private Relay using Oblivious DNS over HTTPS, and even despite dnsleaktest....
heavy-hat-77572's user avatar
1 vote
1 answer
1k views

How to check to see whether DNS over TLS is blocked in my network by ISP?

I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects ...
user avatar
1 vote
0 answers
298 views

using DoH/DoT with your ISP?

Is there a point to using DoT or DoH while your DNS is your ISP from a security (not privacy) standpoint? Assuming I trust my home network, could there be something along the way between my ISP and me ...
Nullman's user avatar
  • 205
1 vote
0 answers
124 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
Mohit's user avatar
  • 11
1 vote
0 answers
2k views

Advantages of running a local private recursive DNS server?

My home network is "governed" by my ISP's router. Sometimes I saw strange packets outside my private IP range, appearing at my computers interfaces. Maybe something crossed VLANs, etc., I do ...
Kamil's user avatar
  • 171
1 vote
0 answers
148 views

Openvpn not hiding dns, using tcp

I am using same configuration files for OpenVPN, same operating system (ubuntu 20) on two different laptops, but I notice with Wireshark, then on one of them, the VPN connection goes through UDP, ...
as2az1's user avatar
  • 11
1 vote
0 answers
406 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
DM3's user avatar
  • 11
1 vote
0 answers
908 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
regress's user avatar
  • 19
1 vote
0 answers
613 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
Jyosk Natalm's user avatar
1 vote
1 answer
481 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
user1857492's user avatar
1 vote
1 answer
958 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack MITM attack. I do the traditional ARP poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
user21303's user avatar
  • 163
1 vote
1 answer
218 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
RD010's user avatar
  • 11
1 vote
0 answers
429 views

Why ever "trust" Nmap's reverse lookup for system hostname when doing host discovery?

Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
5lb Bass's user avatar
  • 111
1 vote
0 answers
222 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
nxl4's user avatar
  • 131
1 vote
0 answers
196 views

Strange DNS resoultion only on my laptop?

Here's a very strange thing I've noticed happening. At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix. In other words, I ...
MBender's user avatar
  • 380
1 vote
0 answers
177 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...
Anton Rasmussen's user avatar
1 vote
0 answers
104 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
bayman's user avatar
  • 123
1 vote
0 answers
105 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
Lordanti's user avatar
0 votes
0 answers
88 views

Understanding DNSSEC NSEC3 output for valid domain name

I am trying to understand NSEC3 record when querying for existing domain name, for NXDOMAIN I understand how it works. RFC has example about WildCard, NODATA & NXDOMAIN So I fired these queries ...
Chits's user avatar
  • 105
0 votes
0 answers
125 views

What is the easiest and most effective way to filter IP-only accesses?

On MacOS and Windows 11, I’ve repeatedly seen direct IP accesses to *.deploy.static.akamaitechnologies.com domains (discovered via PTR DNS lookups). DNS filters like NextDNS presumably don’t see this ...
Patrick Dark's user avatar
0 votes
0 answers
69 views

Need of Transaction SIGnature (TSIG) record

Can't we simply send the shared secret key along with AXFR query? A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
Aryan's user avatar
  • 21
0 votes
0 answers
300 views

How can I monitor which page in the web browser is making a DNS request?

I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
Chris76786777's user avatar
0 votes
0 answers
170 views

endpoint made connection to an IP adress the hostname is not resolving to

Our security product alerted on a possible malicious communication detected by analyzing DNS transactions. The DNS name in question is www.cyber-sale.net. I could correlate this even to another event ...
newby88's user avatar
0 votes
0 answers
163 views

How to properly handle DNSKEY delegation across DNS zones?

I'm trying to implement a toy project DNSSEC supported DNS resolver to learn about both DNS and DNSSEC. Most of my implementation are finished. But for some domains it's not working correctly, and I ...
Rix's user avatar
  • 101
0 votes
0 answers
1k views

Should I be worried about Ignoring query from non-local network in dnsmasq?

I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off: Ignoring query from non-local network Has my network been breached? ...
Sir Muffington's user avatar
0 votes
0 answers
380 views

Should you use encrypted DNS before connecting to a VPN?

The ISP would still see the IP address of the VPN you're connecting to, but it would not be in plaintext compared to normal DNS from what I understand. Should one even bother or just let it be as it ...
secnoob's user avatar
0 votes
0 answers
90 views

Infoblox BloxOne Security Best Practices

I'm looking for some guidance regarding security best practices for Infoblox BloxOne. What I'm looking for specifically are recommended security best practices based on experience using the product.
Nina G's user avatar
  • 133
0 votes
0 answers
130 views

CIS MDBR blocking major libraries (jQuery, gstatic)

The organization I work for uses Malicious Domain Blocking and Reporting (MDBR), which is a service provided by Center for Internet Security (CIS). MDBR technology prevents IT systems from connecting ...
psl's user avatar
  • 101
0 votes
0 answers
150 views

Find configured domains accepted by a reverse proxy

Context I am playing around with a machine from hack the box. I found what appears to be a squid v. 4.6 listening on port 3128. None of my requests works < HTTP/1.1 400 Bad Request < Server: ...
zar3bski's user avatar
  • 111
0 votes
0 answers
199 views

Why is there no DNS mechanism for requiring HTTPS on a domain?

Typically, HTTPS redirection happens like this: The user clicks or types an HTTP link, e.g. http://example.com/url. If the browser has seen a Permanent (301) redirect to HTTPS for that exact URL, it ...
mwfearnley's user avatar
0 votes
0 answers
1k views

MITMPROXY on router

I am familiar with MITM LAN attacks using dnsspoof and arpspoof to read client data. Instead of spoofing the DNS and impersonating the router on my physical machine, I want to set up a MITM LAN ...
Anonymous4225's user avatar