Hot answers tagged

252

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F. $ echo fhepfcelehfcepfffacacacacacacabn | tr a-p 0-9a-f | xxd -r -p | xxd 00000000: 574f 524b 4752 4f55 5020 2020 2020 201d WORKGROUP . This appears to be a NetBIOS name, which ...


124

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got compromised through an unpatched vulnerability in its firmware. I have an Asus AC87U, FW Version 3.0.0.4.380.7743 (1 release behind). Your release is over half a ...


74

Content Delivery Network This is probably part of a Content Delivery Network with a lot of political issues to consider. If you try dig www.whitehouse.gov a, underneath the answer section you'll see the following: www.whitehouse.gov. 131 IN CNAME wildcard.whitehouse.gov.edgekey.net. wildcard.whitehouse.gov.edgekey.net. 731 IN CNAME e4036.dscb....


69

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of services to websites and sits in between the public internet and a server. Someone who uses Cloudflare doesn't point their DNS to their own server - they point ...


67

Same security as other DV certs What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)? Nothing. If you own the network, then you own the network. And DV type certs (see below) ...


58

The decision on whether to use HTTP or HTTPS is the client's. If the user goes directly to http://example.com, an attacker could simply hijack that connection and perform a man-in-the-middle attack. If the user goes directly to https://example.com, then the attacker must spoof the SSL/TLS connection somehow; doing so without showing the user an invalid ...


56

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought down Dyn, your cache would've been invalid and you wouldn't have been able to hit github, etc.


52

Essentially, it doesn't. DNS servers let your computer look up where websites and other services are based on friendly names, by converting those to IP addresses. Your ISP provides this as a service, but knows precisely who you are, and what IP your computer has, so can easily look up to see that @user1 has made a request to look at google.com. A third ...


51

Depending on how your VPN is configured, you might or might not use the same DNS for your VPN and for Internet. VPN's are (typically) like an additional IP stack on your system, and can have a separate DNS server address configured. But not all systems do this. If your VPN does not assign a new DNS for the VPN session then you will continue to use the DNS ...


49

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in for an expired entry, the cache would first try to resolve the name upstream, and if that fails, return the expired entry. I expect this is technically in ...


49

Yes, your registrar can hijack not only your MX records, but your entire DNS. Not only that - but they can then proceed to intercept mail sent to your domain, get a valid CA-signed SSL certificate for your domain, and host a site for your domain using the trusted SSL certificate. And DNSSEC won't prevent any of this. One of the primary functions of your ...


47

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and answer the query themselves. This is not that hard to do. How can I get around this without VPN? A properly configured VPN (i.e. no DNS leaks) can get ...


41

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to ...


35

Well, I've installed Wireshark and applied a DNS filter to see what was happening. When I do the nslookup from Windows to whitehouse.gov I can see in Wireshark that it is appending (without showing it to me) my home DNS suffix (.casa). Then I tried from the Linux machine to resolve anything.gov.casa and it resolved to the said Chinese IP. So I'm pretty ...


35

Update: This answer by Miles is a better insight, the explanation given by NextDNS support seems wrong. I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet connectivity. Knowing where to look, I found numerous references for the same behavior: This article from 2012 discusses the mechanics with similar ...


33

This is a DNS resolution trick that could also be performed using non-http protocols but in this case is performed by using random hostnames and zero-pixel images via http. Look at the source code on the page and you will see a series of random 10-character subdomains requested for several URL's. These are very unique hostnames which neither your computer ...


32

Some common risks to check: Domain has Bad reputation - check for any existing negative online reviews for the domain. Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc. Domain is Black listed - Domain on black lists such as Web of Trust and spam lists. ...


32

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "extended" in many ways. One of them, which has actually been around for a very long time, is to host multiple domains on a single server with a single IP address. A ...


31

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. ...


30

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that ...


29

This would qualify as 'Security through Obscurity' and offers little to no protection whatsoever. The /etc/hosts file is NOT DNS; it's the precursor of DNS and anyone can change their own records in it. A domain name is mainly for human use... the computer will just convert this to an IP address and use that (and send the hostname with it in HTTP 1.1+). ...


28

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to Australian government (to make it simply simple). But since .edu and .gov (et similia) are owned by US for historical reasons, Australia, like some other countries,...


27

The answer depends on the web-server you are using. For example, apache allows for the creation of multiple virtual hosts, of which the first described is considered the default one. What I suggest to do, is to create this default "catch-all" virtual-host with a global deny rule on it. Then configure your own web-site with a virtual-host identified with ...


25

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


25

The syntax for host is: host -t axfr domain.name dns-server For dig: dig axfr @dns-server domain.name Replace dns-server with the authoritative DNS server and domain.name with your target domain name. Keep in mind that this has very little to do with web applications, the above has to do with DNS. If we're talking about penetration testing, DNS zone ...


25

I just found the answer in RFC 6844, DNS Certification Authority Authorization (CAA) Resource Record: A set of CAA records describes only current grants of authority to issue certificates for the corresponding DNS domain. Since a certificate is typically valid for at least a year, it is possible that a certificate that is not conformant ...


23

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


21

UPDATE Your device (W8901G) is in all likelihood VULNERABLE, to the very exploit described below, and more, and even more. I think that the steps suggested below may ameliorate your situation, but unless a firmware fix is available from TP-Link, you should consider replacing your router. The TP-Link search form did not supply any link (W8901G is end-of-...


21

The naming conventions of computers has long been a divisive topic and often the security of a network needs to be put up against the manageability of an environment. I have worked in environments where the server names dictated exactly what that server did, and I've worked in networks with weird naming conventions that did nothing else than tickle the ...


21

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable outside access to it. And yes that DNS 185.183.96.174 is coming from hackers, still alive... dig apple.com @185.183.96.174 This will return: apple.com. ...


Only top voted, non community-wiki answers of a minimum length are eligible