Popular Posts

Blog Archive

Search This Blog

DNS Poisoning - Ethical Hacking | NAHID HASAN TECHNOLOGY

Share it:

Ethical Hacking - DNS Poisoning

DNS Poisoning may be a technique that tricks a DNS server into basic cognitive process that it's received authentic data once, in reality, it has not. It leads to the substitution of false information science address at the DNS level wherever net addresses ar regenerate into numeric information science addresses. It permits AN wrongdoer to switch information science address entries for a target web site on a given DNS server with information science address of the server controls. AN wrongdoer will produce faux DNS entries for the server which can contain malicious content with an equivalent name.
For instance, a user varieties World Wide Web.google.com, however the user is distributed to a different fraud web site rather than being directed to Google’s servers. As we tend to perceive, DNS poisoning is employed to airt the users to faux pages that ar managed by the attackers.

DNS Poisoning − Exercise

Let’s do an exercise on DNS poisoning using the same tool, Ettercap.
DNS Poisoning is quite similar to ARP Poisoning. To initiate DNS poisoning, you have to start with ARP poisoning, which we have already discussed in the previous chapter. We will use DNS spoof plugin which is already there in Ettercap.

Step 1 − Open up the terminal and type “nano etter.dns”. This file contains all entries for DNS addresses which is used by Ettercap to resolve the domain name addresses. In this file, we will add a fake entry of “Facebook”. If someone wants to open Facebook, he will be redirected to another website.

Step 2 − Now insert the entries under the words “Redirect it to www.linux.org”. See the following example −

Step 3 − Now save this file and exit by saving the file. Use “ctrl+x” to save the file.

Step 4 After this, the whole process is same to start ARP poisoning. After starting ARP poisoning, click on “plugins” in the menu bar and select “dns_spoof” plugin.

Step 5 − After activating the DNS_spoof, you will see in the results that facebook.com will start spoofed to Google IP whenever someone types it in his browser.

It means the user gets the Google page instead of facebook.com on their browser.

Defenses against DNS Poisoning

As an ethical hacker, your work could very likely put you in a position of prevention rather than pen testing. What you know as an attacker can help you prevent the very techniques you employ from the outside.
Here are defenses against the attacks we just covered from a pen tester’s perspective −

➤Use a hardware-switched network for the most sensitive portions of your network in an effort to isolate traffic to a single segment or collision domain.
Implement IP DHCP Snooping on switches to prevent ARP poisoning and spoofing attacks.

➤Implement policies to prevent promiscuous mode on network adapters.
Be careful when deploying wireless access points, knowing that all traffic on the wireless network is subject to sniffing.

➤Encrypt your sensitive traffic using an encrypting protocol such as SSH or IPsec.
Port security is used by switches that have the ability to be programmed to allow only specific MAC addresses to send and receive data on each port.

➤IPv6 has security benefits and options that IPv4 does not have.

➤Replacing protocols such as FTP and Telnet with SSH is an effective defense against sniffing. If SSH is not a viable solution, consider protecting older legacy protocols with IPsec.

➤Virtual Private Networks (VPNs) can provide an effective defense against sniffing due to their encryption aspect.

➤SSL is a great defense along with IPsec.

Share it: