Hot answers tagged

123

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got compromised through an unpatched vulnerability in its firmware. I have an Asus AC87U, FW Version 3.0.0.4.380.7743 (1 release behind). Your release is over half a ...


76

Content Delivery Network This is probably part of a Content Delivery Network with a lot of political issues to consider. If you try dig www.whitehouse.gov a, underneath the answer section you'll see the following: www.whitehouse.gov. 131 IN CNAME wildcard.whitehouse.gov.edgekey.net. wildcard.whitehouse.gov.edgekey.net. 731 IN CNAME e4036.dscb....


68

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of services to websites and sits in between the public internet and a server. Someone who uses Cloudflare doesn't point their DNS to their own server - they point ...


65

Same security as other DV certs What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)? Nothing. If you own the network, then you own the network. And DV type certs (see below) ...


58

The decision on whether to use HTTP or HTTPS is the client's. If the user goes directly to http://example.com, an attacker could simply hijack that connection and perform a man-in-the-middle attack. If the user goes directly to https://example.com, then the attacker must spoof the SSL/TLS connection somehow; doing so without showing the user an invalid ...


56

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought down Dyn, your cache would've been invalid and you wouldn't have been able to hit github, etc.


52

Essentially, it doesn't. DNS servers let your computer look up where websites and other services are based on friendly names, by converting those to IP addresses. Your ISP provides this as a service, but knows precisely who you are, and what IP your computer has, so can easily look up to see that @user1 has made a request to look at google.com. A third ...


49

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in for an expired entry, the cache would first try to resolve the name upstream, and if that fails, return the expired entry. I expect this is technically in ...


48

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (which is called a "zone") to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Master DNS server, and one or more Slave DNS servers, and the slaves ask the master for a copy of the records for ...


47

Depending on how your VPN is configured, you might or might not use the same DNS for your VPN and for Internet. VPN's are (typically) like an additional IP stack on your system, and can have a separate DNS server address configured. But not all systems do this. If your VPN does not assign a new DNS for the VPN session then you will continue to use the DNS ...


47

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and answer the query themselves. This is not that hard to do. How can I get around this without VPN? A properly configured VPN (i.e. no DNS leaks) can get ...


41

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to ...


35

Well, I've installed Wireshark and applied a DNS filter to see what was happening. When I do the nslookup from Windows to whitehouse.gov I can see in Wireshark that it is appending (without showing it to me) my home DNS suffix (.casa). Then I tried from the Linux machine to resolve anything.gov.casa and it resolved to the said Chinese IP. So I'm pretty ...


32

Some common risks to check: Domain has Bad reputation - check for any existing negative online reviews for the domain. Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc. Domain is Black listed - Domain on black lists such as Web of Trust and spam lists. ...


31

This is a DNS resolution trick that could also be performed using non-http protocols but in this case is performed by using random hostnames and zero-pixel images via http. Look at the source code on the page and you will see a series of random 10-character subdomains requested for several URL's. These are very unique hostnames which neither your computer ...


31

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "extended" in many ways. One of them, which has actually been around for a very long time, is to host multiple domains on a single server with a single IP address. A ...


30

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. ...


29

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that ...


29

This would qualify as 'Security through Obscurity' and offers little to no protection whatsoever. The /etc/hosts file is NOT DNS; it's the precursor of DNS and anyone can change their own records in it. A domain name is mainly for human use... the computer will just convert this to an IP address and use that (and send the hostname with it in HTTP 1.1+). ...


28

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does. Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if ...


27

The answer depends on the web-server you are using. For example, apache allows for the creation of multiple virtual hosts, of which the first described is considered the default one. What I suggest to do, is to create this default "catch-all" virtual-host with a global deny rule on it. Then configure your own web-site with a virtual-host identified with ...


27

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to Australian government (to make it simply simple). But since .edu and .gov (et similia) are owned by US for historical reasons, Australia, like some other countries,...


25

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


24

The syntax for host is: host -t axfr domain.name dns-server For dig: dig axfr @dns-server domain.name Replace dns-server with the authoritative DNS server and domain.name with your target domain name. Keep in mind that this has very little to do with web applications, the above has to do with DNS. If we're talking about penetration testing, DNS zone ...


22

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


22

I just found the answer in RFC 6844, DNS Certification Authority Authorization (CAA) Resource Record: A set of CAA records describes only current grants of authority to issue certificates for the corresponding DNS domain. Since a certificate is typically valid for at least a year, it is possible that a certificate that is not conformant ...


21

UPDATE Your device (W8901G) is in all likelihood VULNERABLE, to the very exploit described below, and more, and even more. I think that the steps suggested below may ameliorate your situation, but unless a firmware fix is available from TP-Link, you should consider replacing your router. The TP-Link search form did not supply any link (W8901G is end-of-...


21

The naming conventions of computers has long been a divisive topic and often the security of a network needs to be put up against the manageability of an environment. I have worked in environments where the server names dictated exactly what that server did, and I've worked in networks with weird naming conventions that did nothing else than tickle the ...


21

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable outside access to it. And yes that DNS 185.183.96.174 is coming from hackers, still alive... dig apple.com @185.183.96.174 This will return: apple.com. ...


20

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


Only top voted, non community-wiki answers of a minimum length are eligible