Questions tagged [dns]
The Domain Name System (DNS) translates Internet domain and host names to IP addresses.
605
questions
1
vote
2answers
131 views
Domain name vs IP only hosting?
The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
0
votes
1answer
243 views
How can I determine the vulnerability for a sub domain takeover attack?
I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
-3
votes
2answers
291 views
What are the damages when a CDN gets hacked?
I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN:
https://www.welivesecurity.com/2015/06/09/us-army-website-hack/
When ...
1
vote
1answer
192 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
2
votes
1answer
166 views
Is it more secure to set a DNS CAA record to a non-existing CA?
A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example
example.com. CAA 0 issue "symantec.com"
will only allow Symantec to issue ...
1
vote
1answer
231 views
How to prevent MITM DNS attack by router [duplicate]
My landlord is very much a busybody and he has extreme political views. I suspect he is using a Windows program that communicates with the Wifi router to record what websites all the tenants are ...
0
votes
1answer
575 views
DNS Poisoning? Unable to access a specific website
Below are the DNS servers that I have been using for many years:
84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH)
91.239.100.100 Uncensored DNS (IP: 130.225....
1
vote
1answer
291 views
DNS Hijack: Only spoofing sites listed in etter.dns
I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
2
votes
0answers
64 views
DNS objects in Maltego
I don't understand what is a DNS object in Maltego. I know what is the NS and MX information related to a Domain. However, "to DNS Name [Robtex]" transform gives me many DNS Objects and I don't know ...
0
votes
1answer
358 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
0
votes
1answer
3k views
What's the difference between DoH and DoT? [closed]
I'm currently studying the new technologies: DNS-over-https (DoH) and DNS-over-TLS (DoT). I already read the RFC for both of this technologies.
To test DoH, I'm working with Firefox (nigthly build). ...
0
votes
1answer
295 views
DNS resolution when typing IP address into the browser instead of domain
I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com.
Given the understanding of how DNS works I have, to work ...
2
votes
1answer
123 views
OpenVPN configuration and ISP's DNS
I have configured OpenVPN server for using Clouflare DNS - 1.1.1.1. I use OpenVPN connection in the next way: sudo openvpn --config Config.ovpn on my local machine in WiFi network.
My ISP provider ...
1
vote
1answer
70 views
How to secure a domain name from insider threats, domain hijacking in a corperate context?
Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code.
Either an employee has access to ...
2
votes
2answers
201 views
What are the implications of activating “obtain DNS server address automatically”?
There's a (private, password-protected) WiFi network (not under my control) which at first did not work* for my laptop - until I disabled the option that caused it to use google's DNS server.
[*] not ...
0
votes
1answer
55 views
How secret is a dyn dns address?
If I register with a dyn DNS service and am allowed to select my own prefix, how secret is the URL?
For example: I register with a dyn DNS service and ask for my prefix to be 204e9800998ecf8427e and ...
0
votes
1answer
251 views
How to force users on my LAN to use a specific DNS server with arp poisoning?
I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems.
I've had problems in the past trying to configure my router's ...
4
votes
1answer
87 views
Why does majority of the publicly routable IPs seem to have no rDNS assigned?
I built a Hilbert curve showing which IP addresses have rDNS assigned, based on one of the rDNS scan snapshots available on scans.io. I ended up getting the following (white means "assigned"):
Is ...
1
vote
1answer
312 views
Change of DNS in MX records in a Wordpress site
I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
20
votes
5answers
6k views
Does DNS allow third parties to register subdomains?
I have one of those questions that rely on the rule sets for DNS lookup.
Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
0
votes
1answer
64 views
How do I know if I can trust a DNS service
How can I decide if I could trust a given DNS service as a user?
For example I have just seen DNS-Watch which tells me that it is
secure and that they don't log anything.
How can I decide if the ...
0
votes
1answer
106 views
Unexplained DNS connections on boot
I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running.
Immediately after booting the machine I ran:
netstat -tanp
And received this output:
Proto ...
-2
votes
1answer
237 views
What is the difference between DNS flood attack and UDP flood attack?
As title says, what is the difference between DNS flood attack and UDP flood attack?
Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
779 views
What are the possible solution for blocking VPN connection on a home network?
I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
4
votes
2answers
239 views
How can I prevent abuse of our public WiFi network?
One of our customers runs a holiday park with <100 users on it.
We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been ...
6
votes
2answers
1k views
Strange Problem - DNS Cache Poisoning?
I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home:
About three times now in the past year, when I open some website - I'm thrown ...
2
votes
0answers
28 views
DNS search lists cause ambiguity, but what are practical examples of this?
Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
2
votes
1answer
814 views
Difference between DNS flood attack and DNS amplifier attack [duplicate]
I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them?
It ...
38
votes
4answers
7k views
How could a public DNS server return bad results?
I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).
In our country, YouTube, Twitter, Facebook and many other ...
1
vote
0answers
65 views
How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?
This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
4
votes
1answer
228 views
What information is still exposed when visiting an HTTPS website using DNS over TLS?
DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
1
vote
1answer
73 views
Is there any security reason to prefer local IP address over zeroconf “.local” domain name?
I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" ...
2
votes
3answers
117 views
Whitelisting DNS vs. Packet filtering Firewall
I am an information security intern for a MSP.
The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does ...
0
votes
1answer
55 views
SSL with shared webmail URL
I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS.
Now I created CNAME records on my domain to ...
1
vote
4answers
2k views
1.1.1.1 Cloudflare encrypted DNS.Does it still leak IP addresses?
1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its ...
2
votes
0answers
319 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
1
vote
1answer
216 views
Authoritative DNS server resolve also any other domain - Is that a risk?
In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites.
However, I found that those ...
2
votes
1answer
113 views
Need DNS changer app (or method) which actively locks DNS servers [closed]
I have tried all methods in the following link except DNS+DNSCrypt (having issues in flashing files):
https://forum.xda-developers.com/general/xda-university/guide-how-to-change-dns-android-device-...
3
votes
2answers
138 views
Possibility of business calls/leads being professionally stolen? [closed]
Is it possible our VoIP calls being redirected from our intended phone number to another phone number unknown to us? Our VoIP number is currently forwarded to mobile phones and computer phones. ...
0
votes
1answer
639 views
Check router for DNS changer virus
I want to verify that router was not affected by DNS changer virus. Router provided by local Internet provider, runs custom firmware with web admin which does not contain DNS settings, no telnet/ssh/...
1
vote
1answer
171 views
Is it bad to use DKIM DNS without signing mails?
Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that.
Now, if I send an email to a domain/server with DMARC ...
1
vote
1answer
226 views
How does faked DNS manage to downgrade preloaded HSTS?
Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records ...
-3
votes
1answer
75 views
What is the difference between these DNS? Which one is more NSA-proof? [closed]
What is the difference between these DNS servers: 8.26.56.26/8.20.247.20 vs 156.154.70.22/156.154.71.22
Main purpose of using is top anonymity and privacy and security.
thnx
7
votes
1answer
1k views
Why are we developing both DNS over TLS & DNS over HTTPS?
Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?
0
votes
1answer
244 views
third party DNS over ISP DNS - privacy issue
How does using third party DNS like cloudfare 1.1.1.1 DNS helps to protect privacy when ultimately ALL traffics goes through ISP? ISP is the middle man between me and the internet. Since DNS is in ...
1
vote
1answer
128 views
DNSSEC - does the domain owner owns a key?
The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
0
votes
1answer
1k views
Vulnerabilities of DNS when utilized on a TCP port
There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included.
After successfully solving ...
0
votes
1answer
3k views
dnsspoof doesn't spoof DNS request with IP-address of local machine
I want to spoof all DNS requests with the IP address of my local machine.
However, running dnsspoof, all clients receive the real IP address and not the fake IP address of my host.
I know I can ...
6
votes
2answers
2k views
Why is my Windows desktop using a DNS Server on localhost?
I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's ...
0
votes
1answer
881 views
How does Domain Fronting work in practice
While reading about Domain Fronting (and Google and Amazon's decision to ban it), I came across this blog where the author has identified domains that allow fronting.
From the blog, doing something ...
