Questions tagged [dns-spoofing]
DNS Spoofing is a network attack whereby data is introduced into a Domain Name System (DNS) resolver's cache by an attacker that has no authority, causing diverting injected names to redirect traffic to a host controlled by the attacker.
136
questions
4
votes
1
answer
89
views
Cannot consistently demonstrate ARP Spoof and DNS Spoof?
I am trying to use arpspoof and dnsspoof to practice a man-in-the-middle attack between a couple of computers at home. Despite repeatedly following the same exact steps below, I can not get ...
- 275
0
votes
0
answers
42
views
MITM experiment works with DLink DIR-605L but not Hitron CGN3AMF
I am trying to learn about man-in-the-middle. I was able to successfully demonstrate it in when I'm using a DLink DIR-605L wifi router that's connected to a Hitron CGN3AMF wifi modem. But I failed ...
- 275
3
votes
2
answers
2k
views
Understanding TLS Protections Against DNS Spoofing and Fake Websites
What protections does TLS use in the above scenario?
In the picture, the client asks the attacker for the address of Google.com, but the attacker gives them a different ip address which redirects to a ...
- 31
0
votes
1
answer
252
views
can a VPN provider do DNS poisoning?
I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us?
I know browsers check certificates ...
1
vote
2
answers
280
views
DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill
A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
- 13
1
vote
0
answers
167
views
How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?
I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks.
For instance if the server ...
- 141
0
votes
1
answer
273
views
Someone issued fake CAA records for my domain. What is the most important thing to do to resolve it?
First, I can update this with the affected domain, if it's critical, but for obvious reasons I'd like not to be the target of more problems.
Someone registered some CAA records for my domain.
I have ...
- 270
0
votes
1
answer
135
views
Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)
We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
- 3
0
votes
1
answer
327
views
How does the attacker guess the domain name in a DNS query for DNS cache poisoning
Prior to 2008 before Dan Kaminsky finds the DNS issue, the resolver checked only the
Transaction ID. I have seen videos in which it is explained if an attacker manages to send
a DNS response like (...
1
vote
1
answer
468
views
Risks of getting hostname for SSL cert verification via forward-confirmed reverse DNS lookup of user-supplied IP?
My understanding after reading other questions here is that an attacker would need control of the nameserver or the ability to forge responses from it to exploit this. Could it be abused in other ways?...
- 113
2
votes
1
answer
249
views
Does using IP address over Tor with a one essential website expose me to any attack surface?
I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
- 137
0
votes
1
answer
444
views
Can this logic with regard to checking Reverse DNS records be flawed?
For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
- 264
0
votes
1
answer
232
views
how does a DNS request sniffer see packets destined for DNS server?
If a DNS sniffer/spoofer is running on a network using something like netwag/netwox, how does the sniffer see the request that is destined for the real DNS server?
Wouldn't the packets for the DNS ...
- 101
-1
votes
1
answer
126
views
Are purchased domains from third party registrar or hosting managers without Cpanels or VPS or Editable Pages hackable?
If someone buys a domain and one may type the URL in but just sees a template page from the registrar but doesn’t purchase a cPanel or VPS or root access or any way to edit the website, does the ...
- 109
0
votes
1
answer
236
views
DNS local cache spoofing with malware or RAT
I was learning networking and knew that browsers don't have algorithms to convert domain names to IPs. It queries a DNS server.
After that, the computer remembers the IP, so next time the domain is ...
- 119
3
votes
1
answer
487
views
Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?
I'm reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia.
On the subject of DNS cache poisoning, they mention that a "...
1
vote
1
answer
893
views
DNS spoofing over https [duplicate]
If a device sends a request to https://example.com and someone spoofs the DNS response to redirect the request to some malicious server. Would the attacker be able to modify the packets during the TLS ...
- 13
0
votes
1
answer
2k
views
How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]
Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
- 1
0
votes
1
answer
887
views
DNS spoofing protection in Chrome and Firefox
I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
1
vote
1
answer
2k
views
How to prevent from DNS spoofing in Java code which obtains a name of localhost
FORTIFY static scan has detected that this piece of our java code is vulnerable to DNS spoofing attack:
public String getLocalhostName(){
try {
return Inet4Address.getLocalHost()....
- 111
0
votes
1
answer
240
views
Spoofed DNS answers ignored by target machine applications
Attacker: Arch Linux
Target: Windows 10
Scenario
The attackers launches an ARP spoof attack to redirect all target traffic to the attacker. (This works)
The target sends DNS queries for domain name ...
- 23
-2
votes
2
answers
213
views
Dns poisoning for any search [closed]
DNS poisoning works only if we open a certain website.
For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page.
What if we want to redirect the victim to 192....
- 51
1
vote
0
answers
116
views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
1
answer
162
views
What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?
I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
1
vote
2
answers
1k
views
The security of IP whitelisting large ranges
I am not a network expert but; a recent conversation has come up with a client asking to whitelist a range of ip's (let's say 250 odd for now) to transfer their data to us for processing.
I should ...
2
votes
1
answer
1k
views
ARP spoofing + DNS spoofing
To make a prank on a friend, and also for educational purposes, I am trying to hack a DNS server in my local network. I am using Windows. I used arpspoof from GitHub.
Can someone please elaborate on ...
- 207
1
vote
0
answers
2k
views
DNS Packet Spoof Scapy
I am looking into local DNS spoofing by sniffing DNS-requests with Scapy, and sending a spoofed packet in response.
Here is the code I used:
from scapy.all import *
def spoof_dns(pkt):
if (DNS ...
- 2,399
16
votes
3
answers
40k
views
What is the most secure way to store cross subdomain cookies
I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
- 261
1
vote
2
answers
1k
views
Can I alter the DNS cache on my Computer?
Can I alter the DNS cache of my computer.
When I search online it only shows result to flush DNS cache and not how to alter it.
The DNS cache saved on Windows consist of URL,serverIP and many other ...
-1
votes
2
answers
2k
views
How to conduct this MITM attack [duplicate]
For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is:
1) The client request aaa.com
2) The MITM changes the client request to bbb.com
3) The ...
- 539
0
votes
1
answer
906
views
How to implement an active Man-In-The-Middle attack that changes the request URL address
For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack.
The attack scenario that I want to do is a toy example (which has countermeasures ...
- 539
0
votes
2
answers
762
views
Spam Russian Subdomains on my Website
I have the EXACT same problem that was addressed in a former thread on Stack Exchange here:
https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website
As you can see ...
- 109
1
vote
1
answer
207
views
Work internet redirecting to Twitch?
When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel.
I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
- 11
0
votes
1
answer
249
views
DNS Spoof Adware
Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
- 1
0
votes
1
answer
132
views
DNS cache poisoining prevention by directly using ip instead of url
My basic understanding of DNS cache poisoining is that at some local server the cache is been altered. i.e (some urls will be directed to malicious ip address instead of original).
So If I entered ...
0
votes
1
answer
854
views
DNS Spoofing Detection with JavaScript
I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon?
Scenario:
Edit: wrong scenario was ...
- 101
1
vote
3
answers
280
views
Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?
I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
- 111
1
vote
1
answer
243
views
What are the ways to identify a DNS cache poisoning attack?
Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
2
votes
1
answer
1k
views
Certificates for localhost, MITM Attack
Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/
You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
- 163
1
vote
1
answer
974
views
DNS Hijack: Only spoofing sites listed in etter.dns
I'm trying to create a more practical DNS Hijack MITM attack. I do the traditional ARP poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
- 163
0
votes
1
answer
849
views
How to force users on my LAN to use a specific DNS server with arp poisoning?
I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems.
I've had problems in the past trying to configure my router's ...
- 101
23
votes
5
answers
9k
views
Does DNS allow third parties to register subdomains?
I have one of those questions that rely on the rule sets for DNS lookup.
Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to ...
- 357
7
votes
2
answers
1k
views
Strange Problem - DNS Cache Poisoning?
I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home:
About three times now in the past year, when I open some website - I'm thrown ...
- 173
41
votes
4
answers
7k
views
How could a public DNS server return bad results?
I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).
In our country, YouTube, Twitter, Facebook and many other ...
- 499
1
vote
1
answer
221
views
How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?
This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
- 11
1
vote
2
answers
1k
views
VPN protection against DNS poisoning on AP
Does a VPN protect against a malicious DNS configuration on the Access Point?
By my understanding it should, since traffic to the final destination should be encrypted and encapsulated inside packets ...
- 21
1
vote
1
answer
1k
views
Bypassing HSTS and Public-key pinning with lookalike characters
Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack.
Redirect: facebook.com --> faceḃook.com
--
I have seen SSLStrip+ using the technique ...
- 1,867
2
votes
1
answer
191
views
To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?
My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
0
votes
1
answer
323
views
DNSSEC - does the domain owner owns a key?
The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
- 539
5
votes
1
answer
4k
views
dnsspoof and bettercap not dns-spoofing
I want to dns spoof my own phone, because I feel like it would be a cool experiment to do. It's not working (damn phone keeps connecting to the internet), and I would really appreciate any suggestions ...
- 61