Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
7
votes
1answer
4k views

How can I look up a Certificate Authorities CAA record value?

I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot ...
1
vote
0answers
146 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
0
votes
2answers
349 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
480 views

Getting lots of NXDOMAIN response

Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like '...
1
vote
1answer
85 views

Is there a passive way to verify DKIM implementations (on DNS level) without triggering an actual email event?

I wondered if there is a way to verify the correctness/validity of DKIM implementations without actually triggering an email event or sending an email to an external validator. So, remotely, on any ...
-1
votes
1answer
3k views

How do you encrypt DNS traffic in 2017? [closed]

I have seen a couple of questions on here today that recommend DNScrypt for encrypting DNS traffic. However, I feel a little bit of gut inertia that this is not good enough for 2017. What tools do ...
0
votes
1answer
797 views

Is SSL + DNScrypt enough to hide visited domains from my ISP?

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing ...
2
votes
2answers
192 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
0
votes
2answers
132 views

Should entire domains always be blacklisted?

I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...
1
vote
1answer
3k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
5
votes
2answers
339 views

what an attacker can do if he/she got access my router admin panel?

Today I found that anyone can access my router from outside my lan using my public ip. Then after some study, I came to know that the problem was not only with my router but it is a bsnl ...
1
vote
0answers
75 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
0
votes
3answers
364 views

How do I recognize or prevent using a malicious WiFi network?

Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests ...
4
votes
1answer
856 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
0
votes
1answer
403 views

DNS hijacking and Subject Alternative Names

My website is published on Google's Firebase Hosting. I own the domain. Google provision an SSL certificate (lately from Lets Encrypt, it used to be someone else). The certificate is shared between ...
4
votes
1answer
977 views

Can the real IP address leak using curl via Tor?

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org is as ...
2
votes
1answer
115 views

Does CVE-2017-9445 also effect Ubuntu 14.04.X and 16.04.X?

After all the buzz about CVE-2017-9445 it seems unclear to me which versions are really affected and need patching and which not? Their own CVE issue states that Ubuntu 14.04 to the latest upstream ...
2
votes
3answers
605 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
2
votes
0answers
531 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
3
votes
1answer
777 views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
0
votes
1answer
606 views

What are the privacy advantages of a DNS encryption service such as DNScrypt?

Privacy experts recommend dnscrypt (for example r/privacy). The only advantage of DNScrypt I can see is that it protects against an attacker sniffing my DNS traffic (I am using a VPN anyway) and man-...
1
vote
1answer
371 views

Perform man-in-the-middle attack on HTTPS website with same certificate [duplicate]

I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on ...
-1
votes
1answer
543 views

WannaCry DNS abilities

I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out? www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
4
votes
3answers
2k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
8
votes
1answer
1k views

How DNS is leaked? [duplicate]

I am newbie in network security. I cannot understand how can a server detect my DNS servers and how they can be useful to break anonymity. I understand how does the Internet work. How the request is ...
1
vote
1answer
500 views

Does SSL protect you from DNS attacks? [duplicate]

You can't use another website's certificate because when you replace the certificate's domain name with yours the certificate would become invalid (due to hashing). However, if you could make a user ...
0
votes
1answer
86 views

Intruder playing games with my home connection?

Was checking my home router and this appears in my logs just as I try to log in. The log shows system issues, and after my login which is the listed IP, there's a message of a 'DNS' query with a ...
1
vote
2answers
166 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
1
vote
1answer
385 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
1
vote
0answers
109 views

Strange DNS resoultion only on my laptop?

Here's a very strange thing I've noticed happening. At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix. In other words, I ...
-1
votes
1answer
444 views

Unknown website using my domain name [closed]

I own andchat.net which I've left dormant and should not lead to any website. My nameservers were pointing to ns1.linode.com and ns2.linode.com (my previous hosts). Today I just realized if I visit ...
2
votes
2answers
161 views

Securing servers in home network with https

Over time my home network accumulated quite some devices which run web interfaces. They are accessed only locally, from within the home network. What would be the best way to run them with https, ...
3
votes
3answers
2k views

DNS hijack redirect from one HTTPS hostname to another?

I just finished reading a Wired article about a DNS hijack where the attackers redirected all bank traffic to servers they hosted on Google Cloud. What I thought was interesting about the story is ...
5
votes
4answers
4k views

DNS MITM Attack

If you're in a public space (eg. airport, coffee shop) and and mistakenly connect to a rogue access point is it possible for them to intercept your DNS queries and replace them with ones that send you ...
3
votes
1answer
223 views

Inbound traffic from ISP's DNS server [closed]

My Symantec end point traffic logs keep showing that inbound UDP traffic from the DNS server is blocked. This happens every few minutes. Is it a potential attack?
4
votes
1answer
190 views

Without exaggeration, what are the practical security implications of the anti-privacy legislation S.J. Res. 34 for the average Internet user?

A resolution was passed in the US Senate today, that allows US ISP's to sell its users' "browsing data" and private information to third parties. If this resolution becomes a law, does this mean ...
2
votes
1answer
605 views

Is having an incorrect PTR record a security risk?

The Reverse DNS PTR-records (or Pointer Records, or Reverse Record) are often incorrect. Like pointing to: the domain of a hosting provider; a non-existing domain. Let's say I have example.com ...
2
votes
1answer
166 views

DNS sending queries to weird IP

I have noticed some strange activity on a dns server of mine and wanted to pick some brains. Every request being made to this dns server has an additional udp packet being sent to an ec2 IP address in ...
4
votes
1answer
2k views

DNS leak test shows that my ISP swaps google DNS for its own

I've tested DNS for a leak at dnsleaktest.com and I'm getting these results: When I'm not specifying DNS on my PC, it's using default ISP's DNS. When I change it to google's DNS: DNS leak test shows ...
1
vote
1answer
243 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
4
votes
1answer
797 views

How can I detect malicious activity based on patterns of DNS requests? [closed]

I want to know whether a client is infected by detecting malicious activity based on patterns of DNS requests. e.g.Suppose someone hacked google website and injected codes in it and when user clicks ...
2
votes
1answer
124 views

how to ensure that the DNS server is giving me the legitimate information?

if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and ...
2
votes
0answers
351 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
1
vote
2answers
106 views

How much privacy do domain whois privacy services really offer?

I have a domain with my real name, address and contact info on the whois record. I am considering purchasing a privacy service to hide these details. Will that actually help, given that my record is ...
0
votes
1answer
354 views

What are known domain hijacking methods?

The definition of domain hijacking is: "to gain (temporarily) control a domain" which could be either through: Stealing the legal and/or technical ownership of a domain (for example by transferring ...
1
vote
1answer
462 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
274 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
1
vote
1answer
242 views

How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]

Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
0
votes
0answers
332 views

DNS Server being Accessed by Internal and External Host

I came across of a situation in which I can see internal ip and external ip accessing a corporate dns server. I do not know if the dns server is internal dns or external dns. I have very limited ...
1
vote
0answers
108 views

What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?

According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "...