29

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that ...


27

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to Australian government (to make it simply simple). But since .edu and .gov (et similia) are owned by US for historical reasons, Australia, like some other countries,...


19

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are in full control of the organisation which owns the primary domain, which also might decide to delegate control over these domains or some of these domains to ...


9

I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects. Running ad-blockers and script-blockers is effective against most malvertising, but can negatively affect your browsing experience. Sometimes malvertising is targeted at only certain browsers. ...


2

Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties? There is no technical reason they couldn't do this, yet*. DNS records are centrally managed by name servers and records can and do point any which way. The basic text nature of dns records pretty much requires it to ...


2

If you add a HOSTS entry for localhost.example.com and the certificate covers only localhost.example.com then no MITM attack within the network against your system is possible since your system will use the entry from HOSTS and not use DNS to lookup the domain. But, if the application which includes this certificate is not only used by you but by others ...


2

There are lots of potential reasons for this. It could be a misconfigured DNS, the firewall, a work-installed agent on your machine. Or someone on the local network is maliciously redirecting traffic. A network tech might have configured the firewall to redirect certain sites to their favourite Twitch channel so that their browser history looks work-related, ...


2

So If I entered the IP address of a website directly I will not be a victim of DNS cache poisoning ?? This depends on the web server its configuration. Often web server use virtual hosts in order to host multiple domains on the same web server. Based on the domain name, the content of the web page is routed to the proper content directory for that specific ...


2

This can be achieved by adding the desired host entries in the host file.As per my exploration,DNS cache files are not available but you can override DNS cache entries by making entries in system host file. Reference:https://www.rootusers.com/how-to-use-the-hosts-file-to-fake-dns/


2

You could MITM the victim’s DNS connection. When the victim requests a name resolution for a.com, you return the address for b.com. The victim’s browser bar will still say a.com, but they will be communicating with b.com. Or you could MITM the http stream and let the victim connect to a.com, but replace the server’s 200 response with a 302 redirect ...


2

The problem is that someone was able to register the subdomains. I used https://dnsdumpster.com/ and got the following data: outdoorsthatsoftcore1.beginnergolfswingtips.com 31.210.173.89 hosting.eurohoster.org AS197793 LLC Gigabit Russian Federation From the map, it shows that the other DNS has A records. You need to work with the support team of ...


1

Try checking the contents of your actual domain zone, by using a command such as dig (Linux) or nslookup (windows). If the server was exploited, most likely the cPanel won't show anything. How is your domain connected to your server, do you use the DNS service provided by your hosting provider or domain provider?


1

DNS spoofing doesn't change which domain a victim reaches, but rather which IP it thinks the domain points to. As an example, if I try to fetch the DNS A record for http://example.com, and an attacker performs DNS spoofing, they can falsify the DNS A record contents in the response and point me to an attacker-controlled IP address. My browser still shows ...


1

If you are particularly paranoid about someone spoofing dns and a certificate (self-signed, EV or otherwise), then you can statically trust the self-signed certificate by e.g. checking the fingerprint or subjectKeyId (SKI). When you initiate the connection, check the presented certificate against the known-good fingerprint/hash before proceeding. This does ...


1

Generally speaking there are three types of certificates: Self signed certificates: These are certificates that are often generated by an internal certificate authority (CA) where the root certificate is injected in all clients. This way when visiting an internal web application over TLS, no certificate warnings are displayed to the end user. Signed ...


1

Without any help from the site it's really hard, and sadly according to W3Techs statistics many don't still use the technologies that would give you a warning on both DNS cache poisoning and Man-in-the-Middle attacks. Every sites should have TLS certificates now that they are free and easy to get from Let's Encrypt. All CA signed certificates are at least ...


1

You are close, but there are a couple issues. Even though traffic may be redirected to your machine as a result of ARP poisoning, your socket on port 53 will not receive any packets that aren't addressed to your system, which will not be the case if clients have specified their own DNS server (i.e. your machine is on 192.168.1.x, but the packet is destined ...


1

Your goal could be accomplished easily and inexpensively on your home LAN with pi-hole. It allows you to direct DNS requests according to your needs, using a public resolver like Cloudflare or Google for sites that don't need redirection. Simply place your RaspberryPi upstream of your router, and it's just one-line to install and get running. Pi-Hole's ...


1

There's some malware out there that infects websites, but the code is triggered only randomly a fraction of the time. The site can thus appear completely normal to most, and even yourself after a reload, but will still show the bad stuff once in a while. It may either display directly on the site, or provoke a redirect. If you have control of the website ...


Only top voted, non community-wiki answers of a minimum length are eligible