Skip to content

DNS spoofing / cache poisoning

1. Context & stakes

Poison a resolver to hijack a name resolution.

A resolver caches the first answer that matches its query's transaction ID and source port, so an attacker who guesses or races those before the real server gets the forged record cached and every client silently redirected. Kaminsky showed in 2008 how practical this is. Source-port randomisation, 0x20 encoding and DNSSEC validation are the layered defences.

2. Theory

A resolver caches answers keyed by (name, type) and matches replies by source port + 16-bit transaction ID. Forging a reply before the real server answers (matching port+ID) poisons the cache with attacker records. Source-port randomisation raises the entropy; DNSSEC signs records so forgeries fail validation.

3. Attack (PoC)

netlab-dns attack --i-own-this-network --iface veth-host
  1. Race the resolver
  2. Inject a forged answer

4. Detection

netlab-dns detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • DNSSEC
  • Source-port + QID randomization

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading