FREE LOOK

Tweaking dhcp client configuration to change the default DNS servers to Open DNS

The DNS servers of my ISP is always behaving erratically. The DNS look up times are abysmally large and some times I get an address not found error while browsing. On ubuntu/debian systems the DNS servers are specified in /etc/resolv.conf. I tried to edit /etc/resolv.conf and put open dns servers as default DNS servers. But, my ISP supplies their DNS server address along with IP address for the system via DHCP. Every time my system renews its DHCP lease. my /etc/resolv.conf is also rewritten with their DNS address.

My /etc/resolv.conf ( supplied by ISP) looks like this.

$ cat /etc/resolv.conf
domain asianetindia.com
search asianetindia.com
nameserver 202.88.238.3
nameserver 202.88.238.5
nameserver 202.88.231.2

There is a trick I used to make Open DNS servers as my default DNS server.

Edit /etc/dhcp3/dhclient.conf and look for the line.
#prepend domain-name-servers 127.0.0.1;
Add the following line immediately below the above line.

prepend domain-name-servers 208.67.222.222;
prepend domain-name-servers 208.67.220.220;

You can also put any other DNS servers.

Now renew the lease with

$ sudo dhclient eth0

The new /etc/resolve.conf looks like this.
$ cat /etc/resolv.conf
domain asianetindia.com
search asianetindia.com
nameserver 208.67.220.220
nameserver 208.67.222.222
nameserver 202.88.238.3
nameserver 202.88.238.5
nameserver 202.88.231.2

DNS look up is made from open dns.

download file now

Tsunami DNS Amplification Attack Tool

Tsunami is a DNS Amplification Attack Tool which is collected from the internet and modified by Samiux. It is designed for testing your server and/or network under the DNS Amplification Attack. Perform this test on any server and/or network without authorization is a crime and you will be put into a jail.

The number of open recursive DNS servers and the bandwidth of the attacker as well as duration may affect the traffic volume size of the attack.

Tsunami is working perfectly on Kali Linux 1.0.7 or above. The official site is at here.

Usage

To perform DNS Amplification attack :

python amplfiy.py -t 1.2.3.4 -s open_dns.txt -a domain_name.txt -c -1 --verify -v --threads=1000

*where 1.2.3.4 is the victims IP address

To scan for the open recursive DNS server :

perl find_open_resolvers.pl 1.0.0.0 - 1.84.255.255 -q 1000

Remarks : this script just can check if the DNS server has the RA flag or not only. You need to double check with the following command to confirm the scanned DNS server is a true open recursive DNS server.

dig ANY isc.org @samsung.idv.tw

*where samsung.idv.tw is the open recursive DNS server
where isc.org is the domain to lookup

Tsunami comes with the following files :

amplfiy.py - the attack script
find_open_resolvers.pl - the scanner script
gov-uk_domain.txt - domain names of UK Government
open_dns_1.0.0.0-1.84.255.255.txt - open recursive DNS list within 1.0.0.0 and 1.84.255.255 IP range

Thats all! See you.

download file now

Ubuntu Deploy a Simple Docker DNS

This post has been moved.

download file now