- [Instructor] Let's go over a few DNS-related attacks.
The first one that I'm gonna share with you
is the DNS cache poisoning attack.
And it's basically an attack that has been used
by many threat actors in the past.
And basically, in short, it involves the manipulation
of the DNS resolver cache through the injection
of corrupted DNS data.
And this is actually done to force the DNS server
to send the wrong IP address to the victim.
And then, of course, redirecting the victim
to the attacker's system or a malicious website
or any other site that the attacker
actually wants the victim to visit.
DNS cache poisoning attacks can also combine elements
of social engineering to basically manipulate the victims
to download malware,
ask the victim to enter sensitive information
in some type of form or any other spoof application.
There are many different mitigations against this attack.
Nowadays, as a matter of fact,
you actually can configure DNS servers
to rely as little as possible on the trust relationship
with other DNS servers in order to mitigate these attacks.
DNS servers like BIND and for the longest time, actually,
BIND 9.5 and higher, provide features
that actually help prevent DNS cache poisoning attacks.
However, unfortunately nowadays, still a lot
of people are configuring their DNS servers
in an unsecure way and attackers
actually can manipulate them.
Another concept that I want to go over with you
is DNS zone transfer
and DNS zone transfer attacks.
A DNS zone transfer is basically the process
where a DNS server passes a copy of part of its database,
which is actually called a zone, to another DNS server.
This actually allows you to have more than one DNS server
and be able to answer queries
about a particular zone in your environment.
Now there's a master DNS server and the concept
I'll call a slave DNS server.
And basically the slave or the secondary asks the master
for a copy of the records for that zone.
So a best practice is actually to restrict zone transfers
and at the minimum you tell the master
what the IP address of the slave server
and not to transfer to anybody else.
Also, another better way to do this
is to digitally sign the transfers.
So you will ask us,
"So why would an attacker want to perform a zone transfer?"
Well basically by an attacker performing a zone transfer,
he can actually collect a lot
of information from a corporate network,
and sometimes exposing their internal IP addresses
and servers and computers and desktops
and any other elements within their network.
And they actually collect this information
to, you know, perform other attacks
or find vulnerabilities and so on.
Now, to collect information about
the zone transfer, you can actually use the axfr parameter
as I'm actually showin' in here, with the host command.
So, basically, in this case, I'm actually doin'
host
- t
axfr
and then you actually have a domain name and the DNS server.
Now the dig command is very useful
for performing DNS queries on specific DNS servers.
Think of it as a more powerful version of the host command.
Now there's an entity called digi.ninja
that actually has a domain name called zonetransfer.me
that you can actually use for testing.
So you can try to play with that domain
using the host and dig commands
as I'm showin' in the screen.