DNS Cache Poisoning

Website Source: 1 - 2

Keep in mind, it is easy to tell if you are vulnerable. You can perform a simple DNS lookup in order to see if you are vulnerable: dig @dnsserver porttest.dns-oarc.net in txt or go to Dan's site (está off) and run his "Check My DNS" script. The dig command will tell you if your system is "GOOD" or "POOR". Dan's system tells you if you are vulnerable or not.

Comando:

nishv@nishv.com [~]# dig +short @4.2.2.2 porttest.dns-oarc.net txt

Resposta:
porttest.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"209.244.4.25 is GOOD: 26 queries in 1.9 seconds from 26 ports with std dev 3880"


If you don’t get GREAT or GOOD and gets something like POOR, you should immediately stop using it.

If you manage that DNS server, patch it or decommission it!

How2Ubuntu -Choose DNS 1.0

#!/bin/bash
# Choose DNS
clear
set -e
Principal() {
echo "How2Ubuntu DNS Choose 1.0 - Last modify 28.03.10- by charlespito "
echo "------------------------------------------"
echo "Opções:"
echo
echo "1. dns do google (8.8.8.8)"
echo "2. dns da BrTurbo (200.199.201.23)"
echo "3. dns do Uol (200.221.11.100)"
echo "4. dns do Open DNS (208.67.222.222 - 208.67.220.220)"
echo "5. Sair"
echo
echo -n "Digite sua opcão: "
read opcao
case $opcao in
1) dnsgoogle ;;
2) dnsbrturbo ;;
3) dnsuol ;;
4) dns_opendns ;;
5) exit ;;
*) "Opção desconhecida." ; echo ; Principal ;;
esac
}
dnsgoogle() {
echo "GOOGLE DNS =>"
sudo chmod 777 /etc/resolv.conf
echo "nameserver 8.8.8.8" > /etc/resolv.conf
sudo chmod 644 /etc/resolv.conf
sudo /etc/init.d/networking stop
sleep 6
sudo /etc/init.d/networking start
clear
echo "Operação realizada com sucesso."
}
dnsbrturbo() {
echo "BRTURBO DNS =>"
sudo chmod 777 /etc/resolv.conf
echo "nameserver 200.199.201.23" > /etc/resolv.conf
echo "nameserver 200.199.201.24" >> /etc/resolv.conf
sudo chmod 644 /etc/resolv.conf
sudo /etc/init.d/networking stop
sleep 6
sudo /etc/init.d/networking start
clear
echo "Operação realizada com sucesso."
}
dnsuol() {
echo "UOL DNS =>"
sudo chmod 777 /etc/resolv.conf
echo "nameserver 200.221.11.100" > /etc/resolv.conf
sudo chmod 644 /etc/resolv.conf
sudo /etc/init.d/networking stop
sleep 6
sudo /etc/init.d/networking start
clear
echo "Operação realizada com sucesso."
}
dns_opendns() {
echo "OPENDNS DNS =>"
sudo chmod 777 /etc/resolv.conf
echo "nameserver 208.67.222.222" > /etc/resolv.conf
echo "nameserver 208.67.220.220" >> /etc/resolv.conf
sudo chmod 644 /etc/resolv.conf
sudo /etc/init.d/networking stop
sleep 6
sudo /etc/init.d/networking start
clear
echo "Operação realizada com sucesso."
}
Principal

Sniffers

Slides sobre sniffers em geral.

Ceh V5 Module 07 Sniffers

View more presentations from minafaw.