Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
24
votes
5answers
5k views

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
1
vote
1answer
546 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
0
votes
1answer
74 views

dig returns different MX record, can anyone explain why?

I have a domain lets call it example.com when I do: dig example.com MX +short, it returns: 10 mx1.[Internet_Service_Provider_Domain] so, I decided to trace the DNS to check if there any possible DNS ...
1
vote
1answer
65 views

How do DoT and DoH facilitate fingerprinting by resolver operators?

https://dnscrypt.info/faq/ states for both DNS over HTTPS and DNS over TLS that it Provides more information than regular DNS to resolver operators in order to fingerprint clients How so?
1
vote
1answer
118 views

DNS 3rd party risks

I'd like to know what are the risks having a subdomain managed by third party. For example, I manage my own DNS servers to serve mydomain.example which provide some internal and public content. If I ...
0
votes
1answer
48 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
0
votes
1answer
55 views

DKIM and CNAME or DNAME

As far as I understand, there should be no problems with using CNAME or DNAME records in connection with DKIM. That is, while the DKIM record for verifiying a mail from someone@example.com wants to be ...
0
votes
0answers
27 views

How do I block incoming and/or out-going WhatsApp traffic/requests on a Google Wifi Router? [migrated]

I'm interested in methods/solutions for blocking incoming and/or out-going WhatsApp requests and/or traffic on a personal home Google WiFi network. I also have the Google WiFi app with manager/admin ...
0
votes
1answer
65 views

How does openvpn work for only certain servers?

I got a *.openvpn from work and I monitored the traffic on wireshark. On my normal vpn every traffic is routed via the vpn (as expected). But with this work vpn only the traffic that uses the work ...
5
votes
3answers
21k views

What is the Akamai Name Server I see for some big companies?

I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example: $>nslookup > www.redhat.com ...
3
votes
1answer
191 views

Is there a security vulnerability in setting a public DNS entry to a private IP Address?

I recently set up a wireguard server-network configuration with a home server and client devices. I have one main domain that I hope to route everything through via subdomains (in this example, abc....
2
votes
0answers
61 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
0
votes
1answer
192 views

Does it make sense to use CloudFlare's DNS in addition to NordVPN?

Starting at the Computer level, NordVPN gets installed. But according to the experts who know a lot better, a VPN isn't good enough. So going to the router's IPv4 network settings, the default DNS is ...
4
votes
3answers
472 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
12
votes
1answer
2k views

Hijacking stale DNS entry to point to your own website

Context and system configuration: AWS EC2 instance with a public IP address AWS Route53-managed DNS with a somesubdomain.somedomain.io pointing to the above IP address Above AWS EC2 instance was not ...
2
votes
2answers
60 views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
3
votes
2answers
539 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
2
votes
2answers
60 views

Impersonation of TLS host with own wlan network

Problem: I have a local machine (IoT, lets call it MCC) which connects via SSL to a website (mcc.com) to get some JSON data. I would like to send modified JSON from my own server. Idea: Setup a local ...
2
votes
1answer
64 views

How to find out where CNAME had resolved to in the past?

Are there any tools for this? I am doing some research into pentesting and subdomain takeovers with cloud providers like AWS and Azure. I have a list of subdomains (A records) that could be used for ...
2
votes
1answer
124 views

Seems my CNAMEs got “curled”. Somebody please explain this to me

According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
0
votes
1answer
80 views

Why am I seeing SSL events resolve to OpenDNS IPs?

This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to 146.112.255.155 146.112.250.83 146.112.250.64 146.112.250.87 146....
0
votes
1answer
57 views

Why can I still receive email at my old domain after someone else bought it?

My domain expired years ago and was registered by another party. I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes. Now if someone buys ...
1
vote
1answer
63 views

What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
15
votes
2answers
3k views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
-2
votes
1answer
58 views

How did these entries get into the Public DNS? [closed]

try ping these (and everything in between) 021111111111 021555555555 What are they?
0
votes
0answers
61 views

Is there any reason not to enable DNSSEC? [duplicate]

Google Domains' DNS management has a link that says Enable DNSSEC. And, as I understand it, this prevents spoofing of DNS responses. And, that sounds great! So, why wouldn't I want to enable DNSSEC? ...
1
vote
0answers
62 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
1answer
118 views

Does Unbound re-use TLS connections for DoT forwarding?

Unbound has the option to use DNS over TLS as an upstream (through the forward-tls-upstream setting). CludFlare's 1.1.1.1 service offers this; also through TOR. My question is whether Unbound will ...
0
votes
1answer
114 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
1
vote
1answer
155 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
32
votes
6answers
4k views

Is it possible for a name server provider to hijack MX records?

Let’s say: We buy a domain from http://cheap-unsecure-domains.example. Then in our control panel at cp.cheap-unsecure-domains.example we configure it to use the Cloudflare service. We set some MX ...
0
votes
0answers
58 views

Monitor HTTPS URL logging of a specific device of a Network

Goal The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store. Ex. Alexa, Chromecast, and maybe ...
0
votes
1answer
320 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
1answer
38 views

Spoofed DNS answers ignored by target machine applications

Attacker: Arch Linux Target: Windows 10 Scenario The attackers launches an ARP spoof attack to redirect all target traffic to the attacker. (This works) The target sends DNS queries for domain name ...
0
votes
0answers
54 views

Disable mdns-publisher on Linux?

I just installed a firewall and other security-related software on my Linux machine (Ubuntu 18.04), and after reading about them, decided to disable two services that I did't need with: sudo ...
2
votes
1answer
109 views

How dangerous is it to open my DNS server to the world?

I'm using pihole as my DNS on the LAN but I'm trying to use it as my "global" DNS server wherever I am on the planet. One solution is to use a VPN on my LAN and pihole being set as the default DNS ...
1
vote
2answers
88 views

What stops a malicious DNS subdomain provider from impersonating my website?

First, some background: The DNS-01 verification method of Let's Encrypt requires you to add a TXT record to a special subdomain your domain name to prove your identity. With ACMEv2, this can allow you ...
1
vote
2answers
43 views

Private Authoritive Recursive DNS

In the bind9 config (Centos8) there is a note saying If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. I would like to know why and if this is still a concern if the DNS ...
0
votes
0answers
13 views

Search for Passive DNS Replication database [duplicate]

I'm looking for a Passive DNS Replication database. It exists in virustotal and securitytrails. Is there a more comprehensive database of dns data by IP address?
40
votes
8answers
47k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
4
votes
0answers
552 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
1
vote
1answer
794 views

Does using FreeDNS introduce a security risk?

If you use a service like FreeDNS for a DNS, does this introduce any additional security risk as opposed to simply paying a registrar? Obviously the owner of FreeDNS could hijack your domain. But ...
1
vote
1answer
57 views

Is the _acme-challenge subdomain protected?

I was looking into the DNS-01 challenge of Let's Encrypt, and I had a question about the subdomain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to request ...
2
votes
1answer
82 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
2
votes
1answer
53 views

DNS cache snooping protection

Is it possible to protect against DNS cache snooping on ISC bind and PowerDNS servers? If not, is there a similar DNS server software which can't protect agains snooping?
0
votes
0answers
20 views

Does installing and routing OpenVPN DNS queries through a local resolver make any difference to the IP address seen by the eventual DNS server?

This is related to my previous question - When pushing a DNS resolver to an OpenVPN client, does the resolver see the IP address of the client or the OpenVPn server?. If an OpenVPN server ...
3
votes
3answers
8k views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
0
votes
1answer
34 views

When pushing a DNS resolver to an OpenVPN client, does the resolver see the IP address of the client or the OpenVPn server?

When configuring an OpenVPN server, you have the option of pushing DNS resolvers to the client - like so: push "dhcp-option DNS " If this approach is used and a public DNS resolver is defined, will ...
28
votes
3answers
7k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
17
votes
4answers
8k views

DNSSec (Comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec. I've done a little research on DNSSec and its benefits. I ...

1
2 3 4 5
14