TechKnowSurge

VideoSecurityFree

DEMO: DNS Cache Poisoning

DNS cache poisoning is an attack technique in which an adversary inserts fraudulent DNS records into a client's cache, redirecting traffic to malicious or spoofed destinations. Understanding how this attack works is essential for recognizing and defending against it in real-world environments.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DNS cache poisoning, also referred to as DNS spoofing, is a network attack that targets the local DNS cache maintained by client machines. When a system resolves a domain name to an IP address, it stores that mapping in a cache to speed up future requests. By injecting a fraudulent record into that cache, an attacker causes the client to route traffic to an unintended destination, one that may be under the attacker's control or otherwise malicious, without any visible indication that anything has gone wrong. The consequences of a successful poisoning attack can take more than one form. In an adversary-in-the-middle scenario, the attacker intercepts traffic between the client and the legitimate server, gaining the ability to eavesdrop on communications or tamper with data in transit. Alternatively, the attacker may operate a spoofed site designed to impersonate the legitimate destination, harvesting credentials or delivering malware to users who believe they have reached the correct address. Both outcomes rely on the same core mechanism: a corrupted DNS mapping that the client trusts without question. Several techniques can be used to carry out this type of attack. Compromising a DNS server directly gives an attacker control over the records served to all clients that rely on it. ARP cache poisoning can redirect DNS queries to a rogue server, while DHCP spoofing allows an attacker to distribute fraudulent DNS settings across an entire network segment. Domain registration hijacking achieves a similar result at a higher level of the DNS hierarchy. At the endpoint level, modifying the host file on a target machine produces the same effect as cache poisoning, since the host file is consulted before any DNS query is sent, making it a straightforward method for demonstrating how DNS redirection works in practice.

What you'll learn

Explain how DNS cache poisoning works and how adversaries exploit corrupted DNS records to redirect traffic or conduct man-in-the-middle attacks
Identify the techniques used to carry out DNS cache poisoning, including DNS server compromise, ARP cache poisoning, DHCP spoofing, and host file manipulation

What's covered

DNS Cache Poisoning

How DNS Works
- Client Resolves Domain Name
  - Queries DNS Server
  - Receives IP Address
- DNS Cache Function
  - Stores Lookup Results
  - Checked Before DNS Query
- Host File Resolution
  - Resides on Client Machine
  - Checked Before DNS Server
How Poisoning Works
- Wrong Record in Cache
  - Maps Domain to Wrong IP
- Traffic Redirected to Adversary
- Client Unaware of Redirect
Attack Outcomes
- Adversary in the Middle
  - Intercept or Modify Traffic
- HTTPS Spoofed Site
  - Emulated Legitimate Website
Poisoning Techniques
- Hack DNS Server
- ARP Cache Poisoning
- DHCP Spoofing
  - Rogue DHCP Server
- Modify Host File
  - Alter Domain-IP Mapping

Key terms

Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.
DNS Poisoning: An attack that corrupts the DNS cache to redirect users to malicious websites.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Address Resolution Protocol: A protocol used to map an IP address to a physical MAC address on a local network.
Dynamic Host Configuration Protocol: A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Host File: A local file on a client machine that maps domain names to IP addresses, consulted before DNS server queries to resolve domain names.

Topics

Dns Cache Poisoning Dns Spoofing Arp Cache Poisoning Dhcp Spoofing Man In The Middle Network Security

Transcript

DNS cache poisoning can go by many different names. DNS spoofing and DNS cache poisoning are a couple of the common ways that we describe this type of attack. Simply put, DNS poisoning is when an adversary poisons the DNS tables of clients and machines.

How DNS works

Hopefully you know how DNS works and the concepts around DNS, but just to make sure we're on the same page, I'm going to go through a brief explanation. Let's say a client wants to make it to a website — maybe it's the www.technosurge.com website. What it needs to know, really, to route traffic and make a request, is what the IP address is. We route all of our packets based off of IP addresses, so it needs to know the IP address.

Well, how does it go from a name to an IP address? That's what a domain name system does. We have a DNS server over here. So what happens is the client needs to resolve this, and it knows of a DNS server. So what it will do is it will do a lookup on a DNS server and get the information from that DNS server of what is going to be the IP address, and then it can route traffic to that IP address to get to that website and be able to download resources. So that's essentially what DNS is all about.

So that it doesn't have to look up every time it needs to send traffic to this, it has what's called a cache. So that way, when it does this lookup and gets back the answer, it'll put that information in the cache, and it will look into its cache first. So that way it sees, hey, do I have this record? If not, I'll go and find it. But if I do, then I will use that record.

Poisoning the cache

So what an adversary can do to leverage this system is poison the cache. It can put the wrong record inside of the cache. Now, when that machine wants to go to that website again, rather than going directly to the website, instead what it's going to do is look up the wrong IP address. And maybe that's an IP address of the adversary, or maybe it's an IP address of some website that's out on the web that has malicious code involved with it. Whatever the case may be, this is a way that an adversary can trick a client into going to places where it didn't intend to go.

One of the things that you can carry out with this is an adversary attack. So what can happen is the adversary poisons the cache, so that way traffic to www.technosurge.com goes to the adversary instead. Then the adversary goes and retrieves the web page, and it comes back and then it gets sent back to the client. So the adversary now is in the middle of this communication, and therefore can eavesdrop or change something or use it to their advantage.

It wouldn't have to be an adversary in the middle either. Perhaps this adversary has its own website that's up and running that looks very similar to www.technosurge.com but never routes traffic to www.technosurge.com, and instead just acts as if it's the legitimate website. So now when the client does the DNS lookup and finds the wrong record, it gets pointed to the adversary, and the adversary now is communicating back to the client, and the client just thinks that it's on the right site when it's actually an emulated site. It's an HTTPS spoofed site.

Techniques for carrying this out

There are several different techniques that we could do to carry out this type of attack. Number one, we could hack a DNS server. If we hack the DNS server, then we're in charge of those records and can send people to any place that we want to send them to. Then we could also do ARP cache poisoning, so instead of them hitting the actual DNS server, we could send them to the wrong DNS server. We could do the same thing if we gain control over the domain registration — we can actually do it at a much higher level in that case right there. Or we could do DHCP spoofing, where we put a rogue DHCP server on the network and then change people's DNS settings, so that way they have to come to us as the adversary in order to carry out the attack. Or we could change the host files on the computer. The host file is another way that a computer does a DNS lookup.

Demonstration

I'm going to show you how to carry out this type of attack. Now remember, this is for ethical hacking purposes only, so make sure you only do this on your equipment and your network, or equipment and a network that you've been given permission to carry out this type of an attack on.

Before a client ever queries a DNS server, there's actually a couple of stops it goes to. Number one, it goes to its cache to see if something's cached, so that way it doesn't need to do the lookup again. It also goes to the host file. A host file is similar to a DNS server, except it's just a file that resides on the client machine and can do some DNS resolution. So what we're going to do is we're going to alter this host file. And in essence, what we're doing is we're poisoning the cache. And so that's how we're going to do this demonstration. Now this method is a bit of a crude way to go about doing this, but it gets the point across.

What we're going to do is we're going to open up a browser and we're going to browse to technosurge.com. I'll hit enter and it's going to bring up this site.

Now what we're going to do is we're going to pull up a Notepad. And Notepad needs to be ran with administrator privileges, so we're going to run as administrator on this. I just right-clicked on it and said run as administrator. And we are going to open up a specific file. And so here's the path for it: it's on Windows, System32, drivers, etc. We're going to do all files, and we are going to manipulate the host files.

So in here, what I'm going to do is I'm going to type in 10.1.30.23, which is where I'm running a web server at — just a real basic web server, not doing too much at all. And we're going to do technosurge.com as the website. So we'll put that in there. And then we need to save this file.

So once that's saved, let's pull up our website again. And in this case, I will do a refresh with this. Actually, what I'm going to do is delete the S off of it, because that is not a secure site. We'll do that. And you'll notice that it pulls up my real simple website that I'm hosting off of this 10.1.30.23. So what I've done essentially is I've sent them to another website. I've spoofed this website. And this is a real basic one — I haven't really spoofed it very well, but this just gives you an example of how we can poison the cache.

So, with DNS cache poisoning, essentially what we're doing is we are attacking that DNS cache. We're putting in the wrong records that map a domain to an IP. And so once we do that, we can carry out some sort of adversary in the middle attack or HTTPS spoofing attack. And there's lots of different techniques that we could use to be able to poison this DNS cache.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →