48 votes

How could a public DNS server return bad results?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
Steffen Ullrich's user avatar
31 votes

Does DNS allow third parties to register subdomains?

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
reirab's user avatar
  • 2,713
29 votes
Accepted

Does DNS allow third parties to register subdomains?

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
21 votes

How could a public DNS server return bad results?

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from ...
JdeBP's user avatar
  • 701
19 votes

Does DNS allow third parties to register subdomains?

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are ...
Steffen Ullrich's user avatar
17 votes

What is the most secure way to store cross subdomain cookies

From RFC 6265: 5.1.3. Domain Matching A string domain-matches a given domain string if at least one of the following conditions hold: o The domain string and the string are identical. (...
Ghedipunk's user avatar
  • 6,050
13 votes

How could a public DNS server return bad results?

In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
twisteroid ambassador's user avatar
10 votes

Understanding TLS Protections Against DNS Spoofing and Fake Websites

The diagram assumes the initial connection is made using plain text HTTP allowing the attacker to redirect the victim to google.example.com instead of google.com. The TLS does not provide protection ...
Esa Jokinen's user avatar
  • 18.9k
9 votes
Accepted

Modify the hosts file of the router and redirect trafic

It depends a lot on the router. Most household/everyday routers don't have the capability to implement local DNS like you're referring to. See here: https://superuser.com/questions/311877/why-do-most-...
Verbal Kint's user avatar
9 votes
Accepted

Strange Problem - DNS Cache Poisoning?

I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects. Running ad-blockers and script-...
Matt G's user avatar
  • 154
8 votes

Understanding TLS Protections Against DNS Spoofing and Fake Websites

In the depicted scenario, assume that the user's initial request is to https://www.google.com (note the s at the end of https). The user's web browser looks up the A record for www.google.com, but ...
mti2935's user avatar
  • 23.1k
6 votes

What problem does DNSSEC solve?

1. What is the goal of DNSSEC? DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity. The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and ...
Luc's user avatar
  • 32.9k
5 votes

What problem does DNSSEC solve?

It solves integrity guarantee. It will no longer be possible to MITM a signed zone. Right now anyone could falsify DNS records, with DNSSEC they cannot. The client already knows the public key of the ...
John Keates's user avatar
4 votes
Accepted

Unable to Spoof DNS in Kali

Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome ...
Matthew's user avatar
  • 27.4k
4 votes

Modify the hosts file of the router and redirect trafic

Your goal could be accomplished easily and inexpensively on your home LAN with pi-hole. It allows you to direct DNS requests according to your needs, using a public resolver like Cloudflare or Google ...
Matt Zabojnik's user avatar
4 votes

Why do SSL enabled sites don't reply back according to "hosts" file record?

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i....
Steffen Ullrich's user avatar
4 votes

How could a public DNS server return bad results?

Since you are running Linux, an easy way around this without a full fledged VPN is SSH tunelling. If you can set up or get an account on a server in a neutral, unfiltered location, you can tunnel ...
Cameron Roberts's user avatar
4 votes

What is the most secure way to store cross subdomain cookies

There are a few options. One is simple third-party cookies; when the user authenticates, the server returns a page that makes simple requests - each with a short-lived, single-use, verifiable token - ...
CBHacking's user avatar
  • 47.5k
4 votes
Accepted

ARP spoofing + DNS spoofing

I think you misunderstood how such an attack works. You would not alter the default DNS server on the router after ARP spoofing. You could carry out an attack as following: Become man-in-the-middle ...
D.O.'s user avatar
  • 610
4 votes
Accepted

DNS spoofing protection in Chrome and Firefox

Messenger.com is on the HSTS preload list. This means that it requires a https connection, for all browsers that use the HSTS preload list. In addition, any browser which supports HSTS, but does not ...
vidarlo's user avatar
  • 16k
3 votes

DNSspoof not working

Finally, I got it! Dnsspoof can't modify DNS packet, it can only send another prepared packet with spoofed address. But the real packet comes to victim as first and victim's computer take into ...
Samiec Omega's user avatar
3 votes
Accepted

What are the types of DNS spoofing?

There are many different ways to do DNS spoofing: Compromise a DNS server This one is as simple as it sounds. If the attacker controls a DNS server that is in the resolution chain that the victim ...
SilverlightFox's user avatar
3 votes

What are the types of DNS spoofing?

I think you are using wrong keyword for this topic. These are different various of attacks against DNS server and one of them is also DNS spoofing. DNS security threats and mitigations Because of ...
Mirsad's user avatar
  • 10.2k
3 votes
Accepted

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

The reason that you were not able to spoof your source IP address is probably because your ISP uses uRPF (Unicast Reverse Path Forwarding) or some other type of IP validation filtering before routing ...
Maumee River's user avatar
3 votes

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

This means that websites have little incentive to start supporting DNSSEC, as a MITM can spoof a DNS record simply by not including a signature. This is incorrect. If a MITM attacker sends a result ...
ConnorJC's user avatar
  • 336
3 votes

DNS hijack redirect from one HTTPS hostname to another?

For example if I type in to my browser https://www.santanderbank.com and an attacker has taken over that DNS, can they redirect that to a valid https://www.santanderb4nk.com without the browser ...
Steffen Ullrich's user avatar
3 votes

DNS Spoof Adware

HTTPS does not prevent DNS spoofing, since these two protocols work at different layers and in fact HTTPS, because of the X.509 certificates that underline the Web PKI, need the DNS (both at ...
Patrick Mevzek's user avatar
3 votes

How do I redirect HTTPS site to another HTTPS site over LAN using a linux?

This is possible with a proxy server (either configured on the client, or an invisible proxy with a MitM positon), or with spoofed DNS. However, in both cases you'll either need a certificate for the ...
CBHacking's user avatar
  • 47.5k
2 votes

How does DNSSec work? Are there known limitations or issues?

You should probably read "Against DNSSEC" by Thomas Ptacek and its FAQ.
Z.T.'s user avatar
  • 8,484
2 votes
Accepted

Does ARP or DNS spoofing play a role when performing MITM in fake AP attacks?

ARP Spoofing is mostly the basis of MitM Attacks. It is used to redirect the traffic initially. This is done by fooling the victim into beliving that your MAC address is associated to the routers IP ...
davidb's user avatar
  • 4,313

Only top scored, non community-wiki answers of a minimum length are eligible