recentpopularlog in

whip_lash : dns   35

Risk, Failure, Survival: Instrumenting OS for Per Process DNS Query Inspection
But, Process Monitor didn't show the details of the actual calls, so looked into APIMonitor:
http://www.rohitab.com/apimonitor

I set the filter to just look at getaddrinfo and related requests in case I missed something.
dns  windows 
6 weeks ago by whip_lash
GitHub - sysdream/chashell
Chashell is a Go reverse shell that communicates over DNS. It can be used to bypass firewalls or tightly restricted networks.
dns  shell  reverseshell  pentest 
february 2019 by whip_lash
GitHub - Kevin-Robertson/Powermad: PowerShell MachineAccountQuota and DNS exploit tools
The default Active Directory ms-DS-MachineAccountQuota attribute setting allows all domain users to add up to 10 machine accounts to a domain. Powermad includes a set of functions for exploiting ms-DS-MachineAccountQuota without attaching an actual system to AD.
dns  exploit  pentest  powershell  activedirectory 
february 2019 by whip_lash
GitHub - TryCatchHCF/PacketWhisper: PacketWhisper: Stealthily exfiltrate data and defeat attribution using DNS queries and text-based steganography. Avoid the problems associated with typical DNS exfiltration methods. Transfer data between systems without
PacketWhisper: Stealthily exfiltrate data and defeat attribution using DNS queries and text-based steganography. Avoid the problems associated with typical DNS exfiltration methods. Transfer data between systems without the communicating devices directly connecting to each other or to a common endpoint. No need to control a DNS Name Server.
dns  python  steganography 
january 2019 by whip_lash
GitHub - malcomvetter/DnsCache
This is a reference example for how to call the Windows API to enumerate cached DNS records in the Windows resolver. Proof of concept or pattern only.
github  dns  pentest  postexploitation 
december 2018 by whip_lash
xip.io: wildcard DNS for everyone
xip.io is a magic domain name that provides wildcard DNS
for any IP address. Say your LAN IP address is 10.0.0.1.
Using xip.io,

10.0.0.1.xip.io resolves to 10.0.0.1
www.10.0.0.1.xip.io resolves to 10.0.0.1
mysite.10.0.0.1.xip.io resolves to 10.0.0.1
foo.bar.10.0.0.1.xip.io resolves to 10.0.0.1
dns 
september 2018 by whip_lash
Singularity - A DNS Rebinding Attack Framework - KitPloit - PenTest Tools for your Security Arsenal ☣
DNS rebinding changes the IP address of an attacker controlled machine name to the IP address of a target application, bypassing the same-origin policy and thus allowing the browser to make arbitrary requests to the target application and read their responses. The Singularity DNS server is responding with short time to live (TTL) records, minimizing the time the response is cached. When the victim browses to the Singularity manager interface, the Singularity's DNS server first responds with the IP address of Singularity itself where the client-side code (payload) is hosted. When the DNS record times out, the Singularity DNS server responds with the IP address of the target host (e.g. 127.0.0.1) and the victim's browser can access the target application, circumventing the browser's same-origin policy.
dns  pentest  tool 
september 2018 by whip_lash
vysec/DomLink: A tool to link a domain with registered organisation names and emails, to other domains.
DomLink is a tool that uses a domain name to discover organisation name and associated e-mail address to then find further associated domains.

This is useful for bug bounty and red team engagements where you need to discover more domains associated with the target.
recon  dns  pentest 
july 2018 by whip_lash
appsecco/bugcrowd-levelup-subdomain-enumeration: This repository contains all the material from the talk "Esoteric sub-domain enumeration techniques" given at Bugcrowd LevelUp 2017 virtual conference
cheatsheet.pdf - cheat sheet on the sub-domain enumeration techniques covered in the talk
cloudflare_enum.py - A script to do DNS enumeration using Cloudflare service
crt_psql.sh - Extract sub-domains for a given domain using crt.sh postgres interface
esoteric_subdomain_enumeration_techniques.pdf - Slides from the talk
subdomain_enum_censys.py - Extract sub-domains for a given domain using Censys.io API
subdomain_enum_crtsh.py - Extract sub-domains for a given domain using crt.sh RSS feed
subdomain_wordlist.txt - A collection of sub-domain names(around 3 million)
dns  recon  enumeration  pentest 
july 2018 by whip_lash
Homas/ioc2rpz: ioc2rpz is a place where threat intelligence meets DNS.
ioc2rpz transforms IOC feeds into response policy zones (RPZ). You can mix feeds to generate a single RPZ or multiple RPZs. Trusted domains and IPs can be whitelisted. ioc2rpz supports expiration of indicators and accordingly rebuilds zones.
dns  security  github 
june 2018 by whip_lash
Securing DNS across all of my devices with Pi-Hole + DNS-over-HTTPS + 1.1.1.1
Of course you can't simply use this as a DNS resolver, you need something to sit in the middle and speak DNS to your clients and DoH to a provider upstream that answer DoH queries. For that I'm going to use a Pi-Hole and get some extra bang for my buck.
dns  privacy  security 
april 2018 by whip_lash
Feature, not bug: DNSAdmin to DC compromise in one line
We will shallowly delve into the protocol’s implementation and detail a cute feature (certainly not a bug!) which allows us, under some circumstances, to run code as SYSTEM on domain controllers, without being a domain admin.
dns  domain  activedirectory  exploit  privesc  pentest  security 
february 2018 by whip_lash
Fox-IT reveals hackers hijacked its DNS records, spied on clients' files
Protect your website's DNS entries. Choose decent, unique passwords. Enable two-factor authentication on the account. And, if you have the clout, request that your DNS registrar confirm with a manual phone call if there is ever an attempt to point the records elsewhere.
dns  hacking  mitm 
december 2017 by whip_lash
Internet protocols are changing | APNIC Blog
Now, significant changes to the core Internet protocols are underway. While they are intended to be compatible with the Internet at large (since they won’t get adoption otherwise), they might be disruptive to those who have taken liberties with undocumented aspects of protocols or made an assumption that things won’t change.
dns  encryption  http  tls  internet 
december 2017 by whip_lash
Online investigation tool - IP, DNS, MX, WHOIS and SEO tools
Tcpiputils.com provides the ultimate online investigation tool. See detailed information about every IP address, domain name and provider. Perform network tests like DNS lookup, email testing and WHOIS lookup.
domain  networking  tool  IP  Whois  dns 
december 2016 by whip_lash
VPN DNS Guide | WiTopia.Net
When selecting your DNS be sure to choose your DNS based on the gateway location, not based on where you are located. Example if you are in Australia and want to watch the BBC then you want to use a UK DNS server NOT a Australia DNS provider
dns 
march 2012 by whip_lash
DNS Sinkhole ISO Available for Download
Last week, during the SANSFire conference, I did a talk on DNS Sinkhole and made an ISO available for download. It is a ready to install DNS Sinkhole server for those who would like to test and/or deploy one in their network as an internal forwarder. I also indicated that inserting a DNS sinkhole in a network is like putting a NIDS/NIPS inline with potentially several thousand signatures (DNS domains). After you loaded your DNS sinkhole list, it hijacks the client’s DNS requests to known malicious sites responding with an IP address you control instead of its true address. It could also be used to enforce corporate policies (hacking, adults, gaming, social, etc) with the creation of separate sinkhole lists.
dns  security 
june 2010 by whip_lash
Network Tools: DNS,IP,Email
All of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool. Input a domain name or IP Address or Host Name. Links in the results will guide you to other relevent tools and information. And you'll have a chronological history of your results.
dns  tools  email  networking  spam 
december 2009 by whip_lash

Copy this bookmark:





to read