Category Archives: dns spoofing

Risks of getting hostname for SSL cert verification via forward-confirmed reverse DNS lookup of user-supplied IP?

Posted on by

My understanding after reading other questions here is that an attacker would need control of the nameserver or the ability to forge responses from it to exploit this. Could it be abused in other ways?
For context, we have an application t… Continue reading Risks of getting hostname for SSL cert verification via forward-confirmed reverse DNS lookup of user-supplied IP?→

Does using IP address over Tor with a one essential website expose me to any attack surface?

Posted on by

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain address and not the Tor address of my … Continue reading Does using IP address over Tor with a one essential website expose me to any attack surface?→

Can this logic with regard to checking Reverse DNS records be flawed?

Posted on by

For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would be:

Can this be a possible security f… Continue reading Can this logic with regard to checking Reverse DNS records be flawed?→

Are purchased domains from third party registrar or hosting managers without Cpanels or VPS or Editable Pages hackable?

Posted on by

If someone buys a domain and one may type the URL in but just sees a template page from the registrar but doesn’t purchase a cPanel or VPS or root access or any way to edit the website, does the domain or website managed by a domain seller… Continue reading Are purchased domains from third party registrar or hosting managers without Cpanels or VPS or Editable Pages hackable?→

Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?

Posted on by

I’m reading "Introduction to Computer Security", Pearson New International Edition, 1st edition, by Goodrich and Tamassia.
On the subject of DNS cache poisoning, they mention that a "new" attack was discovered in 2008, … Continue reading Does subdomain DNS cache poisoning depend on the authoritative name server ignoring requests for non-existing domains?→