Questions tagged [dns]

The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

Filter by
Sorted by
Tagged with
1
vote
1answer
729 views

Will changing the Wifi router fix a hijacked Wifi problem? [closed]

The other day, I was browsing casually through the web with my laptop. I visited a site that somehow managed to open a popup ad under my notice. This popup ad site I think has malware written all ...
-2
votes
1answer
268 views

Where is payload reside in a DNS frame when tunneling? [closed]

Can anyone explain me about DNS tunneling? where the TCP/IP packet or payload data injected in a DNS frame? How data get decapsulated in the server side? Explain DNS frame?
3
votes
1answer
70 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
2
votes
2answers
141 views

Is allowing public access to a DNS server, a security threat?

If i was to create a DNS server that is hosted at my home, so then i can use it for my VPS servers; am I creating any security threat that can be abused by unknown clients from around the globe? TL;...
2
votes
0answers
29 views

Can another user on my WPA2 WiFi network see my DNS requests? [duplicate]

On a WiFi network with WPA2 security, can another device see the DNS requests that my device makes? My understanding is that with HTTPS, no-one can see the content or full URLs that I connect to. ...
0
votes
2answers
196 views

Why don't more DGA malware families use word-lists?

Of all the known malware families that use DGAs to communicate with their C2, only very few use DGAs that generate non-random-looking domain names. For example, Suppobox generates domain names by ...
7
votes
1answer
6k views

How can I look up a Certificate Authorities CAA record value?

I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot ...
1
vote
0answers
148 views

DNS Leak Detection

While checking my personal VPN server for DNS leaks (and finding them), it got me thinking. If I'm a network owner who hosts a website, and I sniff and log all in/outbound on my web servers, is there ...
0
votes
2answers
489 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
541 views

Getting lots of NXDOMAIN response

Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like '...
1
vote
1answer
98 views

Is there a passive way to verify DKIM implementations (on DNS level) without triggering an actual email event?

I wondered if there is a way to verify the correctness/validity of DKIM implementations without actually triggering an email event or sending an email to an external validator. So, remotely, on any ...
-1
votes
1answer
3k views

How do you encrypt DNS traffic in 2017? [closed]

I have seen a couple of questions on here today that recommend DNScrypt for encrypting DNS traffic. However, I feel a little bit of gut inertia that this is not good enough for 2017. What tools do ...
0
votes
1answer
902 views

Is SSL + DNScrypt enough to hide visited domains from my ISP?

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing ...
2
votes
2answers
198 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
0
votes
2answers
174 views

Should entire domains always be blacklisted?

I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...
1
vote
1answer
4k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
5
votes
2answers
375 views

what an attacker can do if he/she got access my router admin panel?

Today I found that anyone can access my router from outside my lan using my public ip. Then after some study, I came to know that the problem was not only with my router but it is a bsnl ...
1
vote
0answers
78 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
0
votes
3answers
390 views

How do I recognize or prevent using a malicious WiFi network?

Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests ...
4
votes
1answer
940 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
0
votes
1answer
455 views

DNS hijacking and Subject Alternative Names

My website is published on Google's Firebase Hosting. I own the domain. Google provision an SSL certificate (lately from Lets Encrypt, it used to be someone else). The certificate is shared between ...
4
votes
1answer
1k views

Can the real IP address leak using curl via Tor?

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org is as ...
2
votes
1answer
115 views

Does CVE-2017-9445 also effect Ubuntu 14.04.X and 16.04.X?

After all the buzz about CVE-2017-9445 it seems unclear to me which versions are really affected and need patching and which not? Their own CVE issue states that Ubuntu 14.04 to the latest upstream ...
2
votes
3answers
609 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
2
votes
0answers
609 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
3
votes
1answer
1k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
0
votes
1answer
680 views

What are the privacy advantages of a DNS encryption service such as DNScrypt?

Privacy experts recommend dnscrypt (for example r/privacy). The only advantage of DNScrypt I can see is that it protects against an attacker sniffing my DNS traffic (I am using a VPN anyway) and man-...
1
vote
1answer
400 views

Perform man-in-the-middle attack on HTTPS website with same certificate [duplicate]

I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on ...
-1
votes
1answer
596 views

WannaCry DNS abilities

I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out? www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
4
votes
3answers
3k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
8
votes
1answer
1k views

How DNS is leaked? [duplicate]

I am newbie in network security. I cannot understand how can a server detect my DNS servers and how they can be useful to break anonymity. I understand how does the Internet work. How the request is ...
1
vote
1answer
617 views

Does SSL protect you from DNS attacks? [duplicate]

You can't use another website's certificate because when you replace the certificate's domain name with yours the certificate would become invalid (due to hashing). However, if you could make a user ...
0
votes
1answer
90 views

Intruder playing games with my home connection?

Was checking my home router and this appears in my logs just as I try to log in. The log shows system issues, and after my login which is the listed IP, there's a message of a 'DNS' query with a ...
1
vote
2answers
185 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
1
vote
1answer
410 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
1
vote
0answers
124 views

Strange DNS resoultion only on my laptop?

Here's a very strange thing I've noticed happening. At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix. In other words, I ...
-1
votes
1answer
473 views

Unknown website using my domain name [closed]

I own andchat.net which I've left dormant and should not lead to any website. My nameservers were pointing to ns1.linode.com and ns2.linode.com (my previous hosts). Today I just realized if I visit ...
2
votes
2answers
260 views

Securing servers in home network with https

Over time my home network accumulated quite some devices which run web interfaces. They are accessed only locally, from within the home network. What would be the best way to run them with https, ...
3
votes
3answers
2k views

DNS hijack redirect from one HTTPS hostname to another?

I just finished reading a Wired article about a DNS hijack where the attackers redirected all bank traffic to servers they hosted on Google Cloud. What I thought was interesting about the story is ...
5
votes
4answers
5k views

DNS MITM Attack

If you're in a public space (eg. airport, coffee shop) and and mistakenly connect to a rogue access point is it possible for them to intercept your DNS queries and replace them with ones that send you ...
3
votes
1answer
252 views

Inbound traffic from ISP's DNS server [closed]

My Symantec end point traffic logs keep showing that inbound UDP traffic from the DNS server is blocked. This happens every few minutes. Is it a potential attack?
4
votes
1answer
191 views

Without exaggeration, what are the practical security implications of the anti-privacy legislation S.J. Res. 34 for the average Internet user?

A resolution was passed in the US Senate today, that allows US ISP's to sell its users' "browsing data" and private information to third parties. If this resolution becomes a law, does this mean ...
2
votes
1answer
720 views

Is having an incorrect PTR record a security risk?

The Reverse DNS PTR-records (or Pointer Records, or Reverse Record) are often incorrect. Like pointing to: the domain of a hosting provider; a non-existing domain. Let's say I have example.com ...
2
votes
1answer
181 views

DNS sending queries to weird IP

I have noticed some strange activity on a dns server of mine and wanted to pick some brains. Every request being made to this dns server has an additional udp packet being sent to an ec2 IP address in ...
4
votes
1answer
2k views

DNS leak test shows that my ISP swaps google DNS for its own

I've tested DNS for a leak at dnsleaktest.com and I'm getting these results: When I'm not specifying DNS on my PC, it's using default ISP's DNS. When I change it to google's DNS: DNS leak test shows ...
1
vote
1answer
249 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
4
votes
1answer
825 views

How can I detect malicious activity based on patterns of DNS requests? [closed]

I want to know whether a client is infected by detecting malicious activity based on patterns of DNS requests. e.g.Suppose someone hacked google website and injected codes in it and when user clicks ...
2
votes
1answer
156 views

how to ensure that the DNS server is giving me the legitimate information?

if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and ...
2
votes
0answers
394 views

DNS Penetration Test and DNS Cache Poisoning

I'm learning about the Dan Kaminsky attack on a server created to test out the attack. How would I go about using dnspentest? Source code is available by clicking the link above the picture. The ...
1
vote
2answers
107 views

How much privacy do domain whois privacy services really offer?

I have a domain with my real name, address and contact info on the whois record. I am considering purchasing a privacy service to hide these details. Will that actually help, given that my record is ...

1
3 4
5
6 7
14