48 votes

How could a public DNS server return bad results?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
user avatar
31 votes
Accepted

Why doesn't DNS spoofing work against HTTPS sites?

Assume you managed to poison the DNS cache for securesite.com with an IP that you control. Now, when the client visits https://securesite.com, it will resolve to your IP address. As part of the SSL ...
user avatar
  • 3,914
30 votes

Does DNS allow third parties to register subdomains?

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
user avatar
  • 2,693
29 votes
Accepted

Does DNS allow third parties to register subdomains?

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
user avatar
23 votes
Accepted

I don't recognise my DNS server's address: does this mean I am compromised?

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic ...
user avatar
  • 1,068
21 votes

How could a public DNS server return bad results?

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from ...
user avatar
  • 681
20 votes
Accepted

How secure is binding to localhost in order to prevent remote connections?

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, ...
user avatar
19 votes

Does DNS allow third parties to register subdomains?

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are ...
user avatar
13 votes

How could a public DNS server return bad results?

In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
user avatar
11 votes

What is the most secure way to store cross subdomain cookies

From RFC 6265: 5.1.3. Domain Matching A string domain-matches a given domain string if at least one of the following conditions hold: o The domain string and the string are identical. (...
user avatar
  • 5,736
9 votes
Accepted

Strange Problem - DNS Cache Poisoning?

I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects. Running ad-blockers and script-...
user avatar
  • 154
8 votes

How secure is binding to localhost in order to prevent remote connections?

If the service provides a web interface it might be vulnerable to CSRF attacks, XSS attacks or "same site" scripting. All of these can be triggered by just visiting the attackers external website, ...
user avatar
8 votes

Is the Google address being spoofed on my computer?

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out ...
user avatar
8 votes
Accepted

Modify the hosts file of the router and redirect trafic

It depends a lot on the router. Most household/everyday routers don't have the capability to implement local DNS like you're referring to. See here: https://superuser.com/questions/311877/why-do-most-...
user avatar
7 votes
Accepted

Is DNSSEC immune to stripping signatures?

Yes, DNSSEC is immune to this kind of attack. Starting at an anchor (usually the root, sometimes DLV), every delegation is either explicitly secure (presence of DS set on delegation): powerdns.com. ...
user avatar
  • 508
7 votes
Accepted

When using https but not DNSSEC, under what situation, a client is vulnerable?

Properly used https can mitigate the risk of not using DNSSsec because it is checked if the endpoint is the expected one by validating its certificate. Also, the data transport itself is protected. ...
user avatar
6 votes

What problem does DNSSEC solve?

1. What is the goal of DNSSEC? DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity. The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and ...
user avatar
  • 31.8k
5 votes
Accepted

How to determine if resolved ip is rogue or part of CDN?

You might have hit the "Google Global Cache" where servers are placed on your ISPs network to provide lower-latency access to commonly used resources. The fact that visiting that IP address in a ...
user avatar
  • 15.8k
5 votes

What problem does DNSSEC solve?

It solves integrity guarantee. It will no longer be possible to MITM a signed zone. Right now anyone could falsify DNS records, with DNSSEC they cannot. The client already knows the public key of the ...
user avatar
4 votes

DNS spoofing of linux distribution repositories

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use ...
user avatar
4 votes

Why doesn't DNS spoofing work against HTTPS sites?

Let's say you DNS spoof a site, and redirect users to a server you control. Thats possible, but probably of no use if users visit the https version of the site since you do not have the private ssl ...
user avatar
  • 2,249
4 votes
Accepted

How safe is it to use shared SPF record domains?

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com? Yes, competitor can bypass this, but not easily. Lets say that SPF is "v=spf1 ...
user avatar
  • 2,683
4 votes
Accepted

Intercept DNS query packet and send spoofed response after ARP poisoning

You can do this using DNSchef. It is described here at the Kali Webpage. You can also find a useful documentation at the developers webpage. When it gets more complex I suggest you to use ...
user avatar
  • 4,275
4 votes
Accepted

Amazon keeps asking for login/cc info via unsecure page - DNS hijack?

Based on your details something is messing with the DNS settings and since it affects the whole network it is probably the router. Also the fact that the first DNS address in the router was something ...
user avatar
4 votes
Accepted

Unable to Spoof DNS in Kali

Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome ...
user avatar
  • 27.2k
4 votes

Why do SSL enabled sites don't reply back according to "hosts" file record?

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i....
user avatar
4 votes

Modify the hosts file of the router and redirect trafic

Your goal could be accomplished easily and inexpensively on your home LAN with pi-hole. It allows you to direct DNS requests according to your needs, using a public resolver like Cloudflare or Google ...
user avatar
4 votes

How could a public DNS server return bad results?

Since you are running Linux, an easy way around this without a full fledged VPN is SSH tunelling. If you can set up or get an account on a server in a neutral, unfiltered location, you can tunnel ...
user avatar
4 votes
Accepted

ARP spoofing + DNS spoofing

I think you misunderstood how such an attack works. You would not alter the default DNS server on the router after ARP spoofing. You could carry out an attack as following: Become man-in-the-middle ...
user avatar
  • 600

Only top scored, non community-wiki answers of a minimum length are eligible