I try to understand how queries from end-users to the DNS server, can posion the cache of the DNS server.

Example : I try to understand how can attackers that may take control over a computer , can poison the cache of the DNS server that answer that computer's queries?

For my understanding, if the attackers hijacked the DNS server ,they can poison it's cache. If i want to get the ip of lets say www.google.com , how the attackers use my query to poison the dns server cache?

  • How was your DNS server exposed to be attacked in the first place. Was your firewall breached? Was anything else on your network damaged? – Ron Maupin Apr 12 '16 at 21:34
  • It's just an example..i try to understand how queries from end-users can poison the cache of the DNS sever. I'll edit the question. – user2637293 Apr 12 '16 at 22:11

If the DNS, which your computer uses to resolve domain names into IP addresses, is compromised, your PC can be redirected to a malicious IP address, and your PC can be compromised that way.

Instead of resolving to the real www.google.com IP address, your browser can be directed to the www.evilhackersite.com IP address, and the web server there can exploit vulnerabilities in your browser. It may pretend to be Google in order to watch you click on something and steal a password, it may plant malware on you machine, then redirect you to the real Google, or it may exploit some other browser/user weakness altogether.

If you have a machine (one to which others may connect, like a server) which registers with DNS, if the machine is compromised, the malware could register a bad IP address with DNS, causing problems for others, or your machine's DNS queries could be intercepted and redirected before they ever leave your machine.

Also, if your machine is compromised, it could be part of an attack directed at the DNS server to overload it, so that it has no time to validate that its cache entries are correct with more authoritative sources.

  • So, its impossible to poison the DNS cache by just send malicious query? Only to be part of overloading it? – user2637293 Apr 12 '16 at 23:10
  • If you search for dns cache poisoning attack on Google, you will get many hits on examples an tutorials. Even assuming you goal is to prevent such attacks, I'm not really comfortable going into details about how to perform a modern DNS cache poisoning attack, but the greatest number of hosts involved in an attack are used to keep the DNS server busy until it forgets to check the validity of cache entries. – Ron Maupin Apr 12 '16 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.