Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

49 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
3answers
452 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
4
votes
0answers
548 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
3
votes
0answers
2k views

dnsspoof and bettercap not dns-spoofing

I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
3
votes
0answers
36 views

Can some combinations of DNS-entries be security vulnerabilities?

Lets assume you have these DNS-entries for domain.tld: host = domain.tld type = SOA mname = dns.otherdomain.tld rname = hostmaster.otherdomain.tld host = domain.tld type = NS target = ns1....
2
votes
0answers
58 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
2
votes
1answer
64 views

How to find out where CNAME had resolved to in the past?

Are there any tools for this? I am doing some research into pentesting and subdomain takeovers with cloud providers like AWS and Azure. I have a list of subdomains (A records) that could be used for ...
2
votes
0answers
90 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
2
votes
0answers
72 views

DNS objects in Maltego

I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
2
votes
0answers
30 views

DNS search lists cause ambiguity, but what are practical examples of this?

Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
2
votes
0answers
297 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
2
votes
0answers
609 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
2
votes
0answers
394 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
2
votes
0answers
239 views

Non-logging openVPN DNS queries?

I have set up OpenVPN and BIND on a VPS and have a few questions regarding DNS resolving. I have configured bind to push 10.8.0.1 to my client and set the nameserver in resolv.conf to 127.0.0.1. The ...
2
votes
0answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
143 views

bind9 resolves all queries to one address - a compromised server?

Since this morning we tried to open some SSL sites and were greeted by browser warnings, that certificate is not for this site. Upon checking the certificate, we determined that it is issued to *....
1
vote
0answers
62 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
1
vote
1answer
123 views

Seems my CNAMEs got “curled”. Somebody please explain this to me

According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
1
vote
0answers
352 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
1
vote
0answers
58 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
1
vote
0answers
198 views

Is subdomain takeover possible in this case?

I found out that the domain xyz.example.com gives me a 404 error when visited. This domain has the following CNAME > xyz.example.com.ent.syn-alias.com (same 404 page) Which is pointing to another ...
1
vote
1answer
544 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
1
vote
0answers
73 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
0answers
227 views

Why ever “trust” Nmap's reverse lookup for system hostname when doing host discovery?

Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
1
vote
0answers
148 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
1
vote
0answers
125 views

Strange DNS resoultion only on my laptop?

Here's a very strange thing I've noticed happening. At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix. In other words, I ...
1
vote
0answers
111 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...
1
vote
0answers
47 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
1
vote
0answers
47 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
1
vote
0answers
103 views

RHS Blocklist, Other blocklists and impacts of RHS blocking on similar domains

I am not very familiar with Blocklists so had a few queries around it. I have a sub-domain example.com which is used to send mass marketing emails i.e. emails are sent from no-reply@example.com. A ...
0
votes
1answer
73 views

dig returns different MX record, can anyone explain why?

I have a domain lets call it example.com when I do: dig example.com MX +short, it returns: 10 mx1.[Internet_Service_Provider_Domain] so, I decided to trace the DNS to check if there any possible DNS ...
0
votes
0answers
58 views

Monitor HTTPS URL logging of a specific device of a Network

Goal The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store. Ex. Alexa, Chromecast, and maybe ...
0
votes
0answers
51 views

Disable mdns-publisher on Linux?

I just installed a firewall and other security-related software on my Linux machine (Ubuntu 18.04), and after reading about them, decided to disable two services that I did't need with: sudo ...
0
votes
1answer
113 views

Does Unbound re-use TLS connections for DoT forwarding?

Unbound has the option to use DNS over TLS as an upstream (through the forward-tls-upstream setting). CludFlare's 1.1.1.1 service offers this; also through TOR. My question is whether Unbound will ...
0
votes
0answers
20 views

Does installing and routing OpenVPN DNS queries through a local resolver make any difference to the IP address seen by the eventual DNS server?

This is related to my previous question - When pushing a DNS resolver to an OpenVPN client, does the resolver see the IP address of the client or the OpenVPn server?. If an OpenVPN server ...
0
votes
0answers
53 views

Can you use a domain to forward web traffic at DNS to another domain but still use the MX record for this domain

What I am attempting to do is ensure all ingress web traffic [http(s)] to exampledomain1.com forwards to exampledomain2.com but I still want to use the MX record of exampledomain1.com to point to at ...
0
votes
0answers
37 views

How does Smart DNS intercept traffic and what are the implications?

In reading about Smart DNS, my understanding is that a device such as a router is configured with the DNS server IP addresses of the Smart DNS provider as opposed to one that is issued by the ISP or ...
0
votes
0answers
57 views

DNS Spoof Printer on network

I was wondering if it would be possible to arp spoof my printer and router arpspoof -t printer router arpspoof -t router printer and then reroute all print requests to my CUPS print server on ...
0
votes
0answers
38 views

Is there an alternative to HPKP for dyndns?

For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can ...
0
votes
0answers
28 views

How do I white list domain in ASG's?

I need to whitelist https://hooks.slack.com in Application Security Group (ASGs). As I have understood ASGs are static and they don't resolve DNS. Then how do I whitelist https://hooks.slack.com ...
0
votes
1answer
80 views

Why am I seeing SSL events resolve to OpenDNS IPs?

This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to 146.112.255.155 146.112.250.83 146.112.250.64 146.112.250.87 146....
0
votes
0answers
114 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
0
votes
0answers
87 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
0
votes
1answer
114 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
0
votes
1answer
318 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
0answers
364 views

DNS Server being Accessed by Internal and External Host

I came across of a situation in which I can see internal ip and external ip accessing a corporate dns server. I do not know if the dns server is internal dns or external dns. I have very limited ...
0
votes
0answers
90 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
0
votes
0answers
109 views

Silent security on android

I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background. I was wondering if is it possible to achieve tha same results on an ...
-1
votes
1answer
597 views

WannaCry DNS abilities

I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out? www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
-2
votes
1answer
596 views

In DNS Tunneling, What's the DNS Response packet size?

In DNS Tunneling server use RR (CNAME, TXT, NULL) to send back data to the client. My question is what's the size of response packet and how much data can be sent using DNS response in DNS Tunnel ?