Local DNS Attack Lab
SEED Lab: A Hands-on Lab for Security Education
Overview
The objective of this lab is for students to gain the first-hand experience on various attacks on DNS (Domain Name System). DNS is the Internet's phone book; it translates hostnames to IP addresses and vice versa. This translation is through DNS resolution, which happens behind the scene. DNS Pharming attacks manipulate this resolution process in various ways, with an intent to misdirect users to alternative destinations, which are often malicious. This lab focuses on seveal DNS Pharming attack techniques. Students will first set up and configure a DNS server, and then they will try various DNS Pharming attacks on the target that is also within the lab environment.
The attacks conducted in this lab assume that the attacker is on the same local network, and can thus sniff the DNS packets. This assumption is made to simplify the lab tasks. There is a follow-up lab called {\em Remote DNS Attack Lab}, which removes the assumption, i.e., attackers can launch the attack remotely. If you are interested in that, you can work on that lab after finishing this one. It should be noted, the remote attack lab is much more challenging than this one.
Lab Tasks
- VM version: This lab has been tested on our pre-built SEEDUbuntu16.04 VM.
Recommended Time
- Supervised situation (e.g. a closely-guided lab session):
- Unsupervised situation (e.g. take-home project):
Videos (New)
- This topic is covered in my Udemy course: Internet Security: A Hands-on Approach.
- If you are in Mainland China, you can access the same course from the NetEase platform.
Files that are Needed
- Zone Files for DNS Setup
- Zone file for domain example.com: /var/cache/bind/example.com.db
- Zone file for DNS reverse lookup: /var/cache/bind/192.168.0
- Note: If you choose different IP addresses or domain names, you need to modify the above configuration and zone files accordingly.
Suggested Reading
- SEED Book by Wenliang Du
(Book website)
(Chinese version)
- The Pharming Guide: Understanding & Preventing DNS-related Attacks by Phishers.
- Netwox Tools: Here are the manuals of netwox, netwib, and netwag. Netwox is already installed in our pre-built Ubuntu VM images.