Abusing DNS: Part 7, Who is in charge here?
How does your DNS resolver know how to find the DNS server responsible for resolving your DNS address? Why DNS of course. Pretty simple actually, the DNS client asks the DNS resolver for the address the resolver asks its own DNS resolver who asks the DNS server who to ask for the DNS address.
This is where the NS or Name Server record comes in. The NS record is used to identify the authoritative name server for the domain. AKA who is actually in charge.
For this example let's setup a sub domain of offensivecontext.com so that any request for that sub domain will be forwarded to our DNS server. Lets be very creative with the naming and use sub.offensivecontext.com as our sub domain. Meaning we want any query to *.sub.offensivecontext.com to hit our server.
We need two records to setup this up, a NS record and an A record. For example if I wanted all requests to be forwarded to 1.2.3.4 I would setup the following.
| Type | Name | Data |
|---|---|---|
| NS | sub.offensivecontext.com | namserver.offensivecontext.com |
| A | nameserver.offensivecontext.com | 1.2.3.4 |
Visually that would look like this.
Specifics of setting this up is going to depend on your domain registrar, once you have a the above records configured, any of the query types for *.sub.offensivecontext.com will be forwarded to my server at 1.2.3.4.
Wrap up
Getting our system wired into DNS is pretty straight forward, having this setup is going to add some new complications. Next week we will look at adding some more processing in order to deduplicate requests and make the tooling more robust.
