DNS Attack Types Explained

1. DNShijacking (DNS hijacking)
 

DNS hijacking is when an attacker redirects a user's traffic to a legitimate website to a malicious website by modifying DNS records. This attack can be realized in the following ways:

• An attacker hacks into a DNS server and directly modifies DNS records.
   
• Utilizing Man-in-the-Middle Attack (MIMA) to intercept and tamper with DNS query results.
   

2. DNS Cache Poisoning
 

DNS Cache Poisoning is when an attacker injects incorrect DNS data into the DNS resolver's cache, thus enabling users to access the tampered IP address. The specific steps are as follows:

• The attacker sends a DNS response containing false information to the DNS resolver.
   
• The DNS resolver caches the false IP address, causing the user to visit the malicious website.
   

3. DNS Amplification (DNS Amplification Attack)
 

A DNS amplification attack is a technique that takes advantage of the characteristics of the DNS protocol to flood a target server by triggering a large amount of response traffic through a small number of spoofed query requests. The attacker usually does the following:

• The attacker sends small spoofed query requests to multiple open DNS servers.
   
• These servers return a large amount of response data to the attacker, causing network congestion on the target server.
   

4. DNS Tunneling
 

DNS Tunneling is a technique for transmitting hidden data through DNS queries and responses. An attacker can encode arbitrary data into a DNS query or response to bypass detection by security devices such as firewalls. Specific implementations include:

• The attacker splits the data into multiple DNS query and response fragments.
   
• These fragments are transmitted to the target server through normal DNS communication.
   

5. DNS Flooding (DNS flooding attack)
 

A DNS flooding attack is when an attacker sends a large number of DNS query requests to a target DNS server, overloading it and preventing it from processing legitimate requests properly. This attack can be realized in the following ways:

• The attacker sends a large number of DNS query requests using a botnet (Botnet).
   
• The target DNS server is overwhelmed by these requests and crashes.
   

6. Subdomain Attack
 

Subdomain attack is when an attacker floods the target DNS server by creating a large number of subdomain requests. The specific steps are as follows:

• The attacker registers or utilizes existing subdomains and sends a large number of requests.
   
• The target DNS server crashes or suffers performance degradation due to the inability to handle these requests.
   

7. Domain Generation Algorithm Attack
 

Domain Generation Algorithm Attack means that the attacker dynamically generates a large number of domain names, making it difficult to block malicious domain names. Specific implementation methods include:

• The attacker utilizes a specific algorithm to periodically generate a new list of domain names.
   
• These domain names are constantly changing, increasing the difficulty of detection and blocking.
   

8. DNS Rebinding (DNS Rebinding Attack)
 

DNS rebinding attack is when an attacker makes a browser interact with a malicious server by manipulating the DNS response. The specific steps are as follows:

• The attacker first returns the IP address of the legitimate website to the browser.
   
• Subsequently, the attacker utilizes the browser's caching mechanism to bind the address of the malicious server to the same domain name.
   
• The browser will interact with the malicious server on subsequent visits.
   

9. NXDOMAIN Attack
 

The NXDOMAIN attack is when an attacker sends a large number of requests to a DNS server for a non-existent domain name, overloading it. The steps are as follows:

• The attacker sends a large number of query requests for non-existent domain names.
   
• The DNS server crashes or suffers a performance degradation because it cannot handle the requests.
   

10. DNSSEC Bypass (DNSSEC Bypass Attack)
 

DNSSEC bypass attack is an attacker exploits the vulnerability of DNS Security Extensions (DNSSEC) to bypass its protection mechanism. Specific implementations include:

• An attacker exploits a weakness in DNSSEC to forge a valid DNS response.
   
• By bypassing DNSSEC authentication, the attacker can access malicious websites or perform other malicious behaviors.