Hack Security Pro.pdf - Index of

B) DNS hijacking
The DNS protocol is destined to resolve a host name, for example www.thehackademy.net into an IP
address, in order to establish a direct communication with the server in question. The DNS protocol's
format is as follows:
The standard host name resolution procedure is the following one:
1) The client sends a DNS request to the name server in order to resolve the name www.serv.com
into its IP address.
2) The DNS server quizzes the serv.com domain DNS in order to determine the IP of machine www.
3) The DNS server sends back the IP address associated to www.serv.com to the client through a
DNS answer.
The principle of DNS hijacking will therefore be to hijack a DNS response to replace the server IP to
which the victim wishes to connect with the hacker's. He will then be able to freely emulate a site to
recover information (access codes, ...) or simply forward the connection to the server so as to spy on
the communication.
We are going to use the Denver tool (on Linux) to redirect a connection request towards
www.google.com to the www.thehackademy.net website in a way that is transparent for the user. The
options to send are:
-g : Gateway IP.
-h : IP of the host to be hijacked.
-d : Domain to be spoofed.
-p : IP to which the connection must be hijacked.
The Hackademy DMP -93/209- SYSDREAM