48
votes
How could a public DNS server return bad results?
How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8?
They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
- 191k
33
votes
Accepted
Why doesn't DNS spoofing work against HTTPS sites?
Assume you managed to poison the DNS cache for securesite.com with an IP that you control. Now, when the client visits https://securesite.com, it will resolve to your IP address. As part of the SSL ...
- 3,944
31
votes
Does DNS allow third parties to register subdomains?
Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.
DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
- 2,703
29
votes
Accepted
Does DNS allow third parties to register subdomains?
Welcome to Security!
The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
- 5,361
23
votes
Accepted
I don't recognise my DNS server's address: does this mean I am compromised?
Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic ...
- 1,068
21
votes
How could a public DNS server return bad results?
unfortunately they are not doing so!
They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it.
Your confusion stems in part from ...
- 681
20
votes
Accepted
How secure is binding to localhost in order to prevent remote connections?
The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1.
Under normal circumstances, ...
- 19.2k
19
votes
Does DNS allow third parties to register subdomains?
The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are ...
- 191k
15
votes
What is the most secure way to store cross subdomain cookies
From RFC 6265:
5.1.3. Domain Matching
A string domain-matches a given domain string if at least one of the
following conditions hold:
o The domain string and the string are identical. (...
- 5,935
13
votes
How could a public DNS server return bad results?
In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
9
votes
Accepted
Strange Problem - DNS Cache Poisoning?
I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects.
Running ad-blockers and script-...
- 154
8
votes
How secure is binding to localhost in order to prevent remote connections?
If the service provides a web interface it might be vulnerable to CSRF attacks, XSS attacks or "same site" scripting. All of these can be triggered by just visiting the attackers external website, ...
- 191k
8
votes
Accepted
Modify the hosts file of the router and redirect trafic
It depends a lot on the router. Most household/everyday routers don't have the capability to implement local DNS like you're referring to.
See here: https://superuser.com/questions/311877/why-do-most-...
- 727
7
votes
Accepted
When using https but not DNSSEC, under what situation, a client is vulnerable?
Properly used https can mitigate the risk of not using DNSSsec because it is checked if the endpoint is the expected one by validating its certificate. Also, the data transport itself is protected. ...
- 191k
6
votes
What problem does DNSSEC solve?
1. What is the goal of DNSSEC?
DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity.
The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and ...
- 32.4k
5
votes
What problem does DNSSEC solve?
It solves integrity guarantee. It will no longer be possible to MITM a signed zone. Right now anyone could falsify DNS records, with DNSSEC they cannot. The client already knows the public key of the ...
- 820
4
votes
Why doesn't DNS spoofing work against HTTPS sites?
Let's say you DNS spoof a site, and redirect users to a server you control. Thats possible, but probably of no use if users visit the https version of the site since you do not have the private ssl ...
- 2,289
4
votes
Accepted
How safe is it to use shared SPF record domains?
Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com?
Yes, competitor can bypass this, but not easily. Lets say that SPF is
"v=spf1 ...
- 2,733
4
votes
Accepted
Amazon keeps asking for login/cc info via unsecure page - DNS hijack?
Based on your details something is messing with the DNS settings and since it affects the whole network it is probably the router. Also the fact that the first DNS address in the router was something ...
- 191k
4
votes
Accepted
Intercept DNS query packet and send spoofed response after ARP poisoning
You can do this using DNSchef. It is described here at the Kali Webpage. You can also find a useful documentation at the developers webpage.
When it gets more complex I suggest you to use ...
- 4,303
4
votes
Accepted
Unable to Spoof DNS in Kali
Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome ...
- 27.3k
4
votes
Why do SSL enabled sites don't reply back according to "hosts" file record?
The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i....
- 191k
4
votes
Modify the hosts file of the router and redirect trafic
Your goal could be accomplished easily and inexpensively on your home LAN with pi-hole. It allows you to direct DNS requests according to your needs, using a public resolver like Cloudflare or Google ...
- 181
4
votes
How could a public DNS server return bad results?
Since you are running Linux, an easy way around this without a full fledged VPN is SSH tunelling. If you can set up or get an account on a server in a neutral, unfiltered location, you can tunnel ...
- 141
4
votes
Accepted
ARP spoofing + DNS spoofing
I think you misunderstood how such an attack works. You would not alter the default DNS server on the router after ARP spoofing. You could carry out an attack as following:
Become man-in-the-middle ...
- 600
4
votes
Accepted
DNS spoofing protection in Chrome and Firefox
Messenger.com is on the HSTS preload list. This means that it requires a https connection, for all browsers that use the HSTS preload list.
In addition, any browser which supports HSTS, but does not ...
- 14.9k
3
votes
DNSspoof not working
Finally, I got it!
Dnsspoof can't modify DNS packet, it can only send another prepared packet with spoofed address. But the real packet comes to victim as first and victim's computer take into ...
- 31
3
votes
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
FCrDNS should only be required when the end user needs to properly identify itself with a domain or organization, commonly used for email where the from address header should match the PTR of the ...
- 171
3
votes
Accepted
Are there any statistics about packet filtering to prevent IP spoofing on the internet?
The reason that you were not able to spoof your source IP address is probably because your ISP uses uRPF (Unicast Reverse Path Forwarding) or some other type of IP validation filtering before routing ...
- 384
Only top scored, non community-wiki answers of a minimum length are eligible