DNS Basics & Common Attacks

Authored by:

Raiders

Web3Sec.News & Digibastion.com

Reviewed by:

matta

The Red Guild | SEAL

How DNS Resolution Works

When users type your domain, their request may traverse multiple trust points (flows vary by resolver caching, stub resolver config, and provider):

1. Local device cache
2. ISP/recursive DNS resolver
3. Root nameservers
4. TLD registry servers
5. Your authoritative nameservers

Each step represents a potential attack surface where responses can be intercepted, modified, or poisoned. This multi-step process creates numerous opportunities for attackers to redirect users to malicious sites while their browser still shows the correct domain name.

Common Attack Vectors

• Social Engineering at Registrars: Attackers convince/bribe support staff they're legitimate owners using publicly available information
• Expired Domain Sniping: Domains that expire enter a grace period before becoming publicly available to anyone (note: grace/redemption periods differ per TLD)
• DNS Hijacking: Unauthorized changes to DNS records redirecting traffic to malicious servers
• Email Interception (MX tampering): Password reset attacks and communication interception
• DNS Tunneling: Encoding data within DNS queries for covert communication channels, often used for data exfiltration
• DNS Cache Poisoning: Injecting forged responses into a resolver's cache to redirect subsequent queries