ICT Ethical Hacking: DNS and DHCP Attacks and Prevention

This article covers the basics of DNS and DHCP in ICT Ethical Hacking. It explains DNS Raid, DNS Transmission, and types of DNS attacks such as DNS Spoofing and DDOS. It also covers DHCP snooping concepts and types of snooping. The article provides step-by-step procedures for DNS spoofing and DHCP snooping and prevention methods for both attacks.

ICT Ethical hacking

Table of Contents
1 Introduction.......................................................................................................................................2
2 Domain Name System........................................................................................................................2
2.1 DNS Raid....................................................................................................................................3
2.2 In what way DNS Transmission works....................................................................................3
2.3 Types of DNS attack..................................................................................................................3
2.3.1 DNS Spoofing.....................................................................................................................3
2.3.2 DDOS................................................................................................................................10
3 DHCP................................................................................................................................................15
3.1 Definition..................................................................................................................................15
3.2 How DHCP works....................................................................................................................15
3.3 DHCP snooping concepts........................................................................................................16
3.4 Types of snooping....................................................................................................................16
3.4.1 DHCP Snooping...............................................................................................................17
3.4.2 DNS starvation attack......................................................................................................19
4 Installation steps for Kali Linux.....................................................................................................25
5 Conclusion........................................................................................................................................31
6 References........................................................................................................................................31
1

1 Introduction
Information and communication technology is to enlarge coaching and training environments. It
permits self-training with the help of different tools like tasks. As an effect of coaching and
training, it develop into more beneficial and worthful. In this Ethical hacking, Domain Name
System will be studied. After explained that, DNS attack and its types will be revised. Then DNS
snooping will be analyzed. After that step by step procedure will be explained. And finally
prevention of DNS snooping will be explained. Dynamic Host Configuration Protocol (DHCP)
will be revised. After explaining that, Types and Step by step procedure will be analyzed. And
finally Prevention of DHCP snooping configuration will be explained.
2 Domain Name System
DNS is Domain Name System. It is used for change the domain name into their respective IP
address in TCP/IP protocols. DNS have a network protocol for memorizing host name and
address through a distributed data base. The domain name system directing the user to locate a
website with the conversion of domain name into IP address. The DNS is used for translating
human format name of site into the IP address (Zheng, 2014).
2

2.1 DNS Raid
DNS Raid is also known as attacks on DNS. In DNS raid the attacker can change the IP address.
If the user can access that webpage, the attacker can get the information about the user. The wide
usage of internet is the main reason for DNS attack. Now a days, DNS attacks are very common.
The DNS attack is some hacker change the IP address of a website. When a user access the
website automatically the hacker can get the details of a user (Lee, Baek & Kim, 2015).
2.2 In what way DNS Transmission works
The goal of DNS server is converting or changing the domain name into the respective IP
address. It works like a mapping. When a server gets the IP address all information will start
relocating from website server to client and client to website server.
2.3 Types of DNS attack
The different categories of DNS attacks are given below.
 DNS spoofing
 DNS Amplification
 DNS Tunneling
2.3.1 DNS Spoofing
DNS spoofing is a type of DNS attack. In this attack the hacker can change the fake website to
look like an original real website. The hacker done with the diverting traffic of the users.
Spoofing attacks can go for long time period without being detected and sometimes it may cause
serious issues. DNS spoofing is also called as DNS hijacking (Zhang & Xia, 2013) (Sridevi &
Dr.Manjaiah D.H, 2012).
3

DNS spoofing is the changing of IP address from one to another address. The attacker can
redirect all DNS requests to attacker's/ Hacker's machine or computer. It is one of the way of
stealing the information from the user. It is one of the deadly attack. It is very hard to identify
whether the information are stealing or not.
2.3.1.1 Step by step procedure of DNS spoofing
Step 1: start Kali
Click on applications. There will show lot of option in list view and choose kali Linux. After
choosing kali Linux select Sniffing. After selecting that sniffing you have to choose Network
sniffers. At last select dnsspoff.
4

Step 2: Access dnsspoof
After clicking dnsspoof, the upcoming terminal will appears automatically. The syntax is shown
in below figure.
Step 3: Composition for Sniffing
In windows 7 system bankofamerica.com webpage is redirect into our webpage. Here we can use
browsers like Google chrome, opera etc.
5

Step 4: Flush the DNS storehouse
The first step is DNS storehouse flushing in window 7. By this method, the client can't use the
DNS storehouse on his or her system. But in reality, this step is no need.
Terminate the browser after that type the following things:
 ipconfig
The first step is make the network card on kali Linux server for accepting all packets.
 ifconfig etho promisc
Then we terminate the transmission between webpage of bankof america and web server of
windows 7.
 tcpkill -9 host [www.bankamerica.com]
After terminating the webpage of bankofamerica, conclude the tcpkill with the help of ctrl + c.
Step 5: creating a list of Host
The Linux on client DNS shows that the host list is acting as a fixed DNS. With the help of host
list or file we can redirect the webpage of bankofamerica instead of our webpage.
 cd /usr/local
With the help of text editor we can open list of host. Here we are using Back Track methods so
kali don't have a write on it. But the kali contain graphical VIM. Graphical VIM named as gvim.
6

 Hosting the gvim
We have the list of host, so we want to include the upcoming line to it. We change an IP address
and map that IP address to webpage of bankofamerica.
 192.168.1.101
The TAB key is used to domain from IP address and to IP address from domain. No spaces are
allowed sometimes it may interpret by domain name's part.
Step 6: BOA webpage creating
In this step, we are going to create a webpage named as BOA.
 ifconfig eth0 -promisc
In this step we need to generate a webpage, which is redirected to the Webpage of BOA. We can
create a simple webpage instead of bankofamerica.
Open index.html.
The index page will displayed in the below figure and the coding is also displayed.
7

Step 7: Starting Web server
In this step we are going to start the web server. First click on application then select kali Linux.
After selecting kali Linux some list were appear. From the appearing list you have to select
system services. Then select HTTP. At last click apache2. The web server apache2 will be
started.
8

Step 8: Openting Dnsspoof
This is the last step.In this step, we can start dnsspoof and redirect the user to access our
webpage.Here we mapped the webpage of BOA. Then it will go to webpage of our site. The
sysntax is also included in below figure.
9

Step 9: Route the BOA webpage into our webpage
Now the user can type the URL bankofamerica.com this URL will redirect to our fake webpage.
2.3.1.2 Prevention of DNS spoofing:
Few idea for away from DNS spoofing. The ideas are given below
 Implement of DNS spoofing detection techniques- Some product named as Xarp, which
is used to product the ARP storehouse from DNS spoofing.
 Work with encrypted data networks- SSL/TLS will use for decrease the DNS spoofing by
usage of end-to-end encryption.
 Use DNSSEC-DNSSEC have the digital DNS record for data security (Gupta, Kumar,
Tomar & Verma, 2016) (LI, CAO, LIU & LEI, 2011).
2.3.2 DDOS
DDOS stands distributed denial-of-service. It attack a network to become unavailable to planned
user with the help of other computers. DOS attack is done by large number of systems improve
that server usage and denial of service of that system. The server can be targeted by many
(Sridevi & Dr.Manjaiah D.H, 2012).
10

.
2.3.2.1 Step by step procedure of DDOS in kali Linux
Step 1: Kali Linux should have with the USB Wi-Fi adapter and type the upcoming comment in
terminal.
Step 2: With the help of Airmon-ng.Package and start the wireless adapter. The command for
start the wireless adapter is given below
11

Step 3: With the help of SSID Flooding we can struck the network. But it is not a denial of
service.
Step 4: Text file is created by the name of yeahhub.list
12

Step 5: Run the command and the command is in below figure.
Step 6: In the below figure, Base service set identifier is reffered from MAC address.
13

Step 7: For DE-authentication mode, we should save BSSID address in file. Specify a file in
option –b.
Step 8: In the below figure De-authentication is referred as d and b have MAC address attacked
file name.
2.3.2.2 Prevention of DDOS attacks
 In a networks we continuously checking and verifying the IOT devices.
 Check whether all the default password is strong or not.
 Anti-virus should be installed and maintained.
 Firewall should be installed and configured into restrict traffic for incoming and outgoing
in networks.
 Universal Plug and Play should be segmented and applied security controls.
14

3 DHCP
3.1 Definition
DHCP is a networking law that organize the address for communication. In earlier days, devices
were appointed as fixed address. But fixed address is used by DHCP i.e. Dynamic Host
Configuration Protocol which is used for allocating the IP address dynamically.
By accidently rouge Servers of DHCP were enabled. For Ex. A user want to extend their wireless
network into his computer. For that the user can plug Wireless router into his workstation or
computer. (Liberman, 2016) (Younes, 2016).
3.2 How DHCP works
All the network hosts were asking the DHCP server to send a message of client
broadcast. In message unique identifiers are used by client by MAC address. MAC address is
return address. The DHCP network management is used on TCP/IP networks by assigning an IP
address with the help of DHCP server. Other network parameters of each devices interact with
another IP protocols (Mukhtar, Salah & Iraqi, 2012) (Younes, 2016).
15

3.3 DHCP snooping concepts
For all network switches DHCP snooping is main feature. Servers are used to design and
mitigate issue with a rogue DHCP servers.
The concept of DHCP snooping is using for more than one ports which is identified by correct
DHCP server. The snooping concept is clients can communicate through networks. The building
tables can builds the switch. The building tables is a database having group of client MAC
address (Park, 2016) (Kadafi & Khusnawi, 2015).
3.4 Types of snooping
In symmetric multiprocessing memory cache establish snooping protocol. Each processors stores
on bus monitors. The bus monitors have a requested data block snooping. The bus is used to
check the requested data book is copied or not. Other processor can copies the data before the
processor writes the data. Another name of snooping protocol is bus-snooping (Younes, 2016).
16

3.4.1 DHCP Snooping
3.4.1.1 Step by step procedure of DHCP Snooping
step1: Configure the VLAN employee-van with VLAN ID 20:
[Edit vans]
Step 2: Configure an interface on Switch 1 as a trunk interface:
[Edit interfaces]
Step3: Associate the VLAN with interfaces ge-0/0/1, ge-0/0/2, ge-0/0/3, and ge-0/0/11:
[Edit interfaces]
Step4: In VLAN, DHCP was enabled:
[Edit Ethernet-switching-options secure-access-port]
Step5: Enable DAI on the VLAN:
[Edit Ethernet-switching-options secure-access-port]
17

Step6: Configure a MAC limit of 5 on ge-0/0/1 and use the default action, drop (packets with
new addresses are dropped if the limit is exceeded):
[Edit Ethernet-switching-options secure-access-port]
Step 7: Clear the existing MAC address table entries from interface ge-0/0/1:
3.4.1.2 Prevention of DHCP snooping
The main problem of DHCP is DHCP spoofing. An Untrusted client’s travel with DHCP
message. Coping the DHCP message to control plane is the one of the simple prevention in
DHCP snooping. The data in the pockets are using to create anti-spoofing technique (Radha,
Jayaparvathy, Shanmughi & Jothilakshmi, 2016).
Access the appropriate hierarchy for either a VPLS or bridge domain configuration.
user@host# edit routing-instances blue
1. Specify that you want to configure DHCP relay.
[Edit routing-instances blue]
2. Create the group and assign a name.
[Edit routing-instances blue forwarding-options duct -relay]
18

3. Specify the names of one or more interfaces. DHCP will trust only the MAC addresses
learned on the specified interfaces.
[Edit routing-instances blue forwarding-options dhcp-relay group svl-10]
3.4.2 DNS starvation attack
DHCP Starvation attack perform by DHCP message which is broadcast with MAC address in
spoofed. It is achieved by tools like 'the gobbler’. A rogue DHCP server is set up by the network
hackers which is used to respond DHCP request from client on systems. This attack is similar to
synchronization flood attack and it is most vulnerable to DOS attack which is also called as
starvation attack of classic DHCP.
19

3.4.2.1 Step by step procedure for DND starvation attack
Step 1:
All hosts are renting IP address from server sho ip dhcp bind.
Step 2:
sho ip dhcp server statistics is the command used to access the condition of DHCP router.
20

Step 3:
sho ip dhcp pool is the command shows the leasing DHCP address available condition.
Step 4:
The above steps are implemented in Yersinia.Now in Kali Linux Yersinia –G is typed to launch
the whole program in graphical mode.
21

Step 5:
In the below screenshot we can see the statistics for 802.1Q, CPD and other bunches.
Step 6:
Now select the sending DISCOVER packet option and then click ok. In few seconds the router
will be in offline mode.
22

Step 7:
Now the local subnet is destroyed.
Step 8:
Now type show ip dhcp bind then it shows the DHCP bindings.
23

Step 9:
Below screenshot shows the DHCP server could not be locked because the router is busy in
packet deluge drowning.
Step 10:
switchport mode port-security command is used to keep the MAC address in minimum number.
3.4.2.2 Prevention of DHCP starvation attack
 DHCP starvation attack is relieved by using encapsulated DHCP packets with some other
MAC addresses in an interface.
 To set the MAC learning limit Maximum count of mac address should be executed
 Unknown frame should be disabled at learning time of Mac.
 With the same mac address and usage of DHCP request, DHCP starvation attack will be
prevented.
24

4 Installation steps for Kali Linux
Step 1
At first boot with installation medium that are chosen, then we can see the menu showing Kali
Linux boot menu. Two modes of installation is available one is GUI and another is Text-Mode
install. In this we select GUI install.
Step 2
Then select preferred country location and language and we should configure the keyboard with
the help of keymap.
25

Step 3
Then the installer copy the image in hard disk and then a prompt window is opened in that enter
the hostname of the system. Kali is entered as hostname.
Step 4
For the root account enter the robust.
26

Step 5
Then time zone is set up.
Step 6
Now the installer shows the four choices. For the installation of Encrypted LVM, select “Guided
– use entire disk and set up encrypted LVM” option.
27

Step 7
Select the destination to install Kali. In the below screenshot we have chosen destination drive as
USB. Then this USB drive is used to boot the Kali in encrypted form.
Step 8
Partitioning scheme can be confirmed. And Installation can be continue.
28

Step 9
Encryption password will be asked. Remember the password and use the same password for
every booting time.
Step 10
Network mirrors can be configured. Proxy information should be entered.
NOTE: If NO is select, you can't install packages
29

Step 11
Then installation of GRUB is done.
Step 12
Click reboot in new kali installation. Check the USB device is booting enabled. On every boot,
set the encryption password.
30

5 Conclusion
In this Ethical hacking, Domain Name System is studied. After studied that, DNS attack and its
types is revised. Then DNS snooping is analyzed. After that step by step procedure is explained.
And finally prevention of DNS snooping is explained. Dynamic Host Configuration Protocol
(DHCP) is revised. After explaining that, Types and Step by step procedure is analyzed. And
finally Prevention of DHCP snooping configuration is explained.
6 References
Gupta, T., Kumar, S., Tomar, A., & Verma, K. (2016). DNS Prevention Using 64-Bit
Time Synchronized Public Key Encryption to Isolate Phishing Attacks. International
Journal Of Security And Its Applications, 10(8), 395-406.
http://dx.doi.org/10.14257/ijsia.2016.10.8.35
Kadafi, M., & Khusnawi, K. (2015). Analisis Rogue DHCP Packets Menggunakan
Wireshark Network Protocol Analyzer. Creative Information Technology
Journal, 2(2), 165. http://dx.doi.org/10.24076/citec.2015v2i2.46
Lee, K., Baek, S., & Kim, S. (2015). Study on the near-real time DNS query analyzing
system for DNS amplification attacks. Journal Of The Korea Institute Of Information
Security And Cryptology, 25(2), 303-311.
http://dx.doi.org/10.13089/jkiisc.2015.25.2.303
LI, W., CAO, X., LIU, F., & LEI, Z. (2011). Improving DNS cache to alleviate the
impact of DNS DDoS attack. Journal Of Networks, 6(2).
http://dx.doi.org/10.4304/jnw.6.2.279-286
Liberman, E. (2016). Windows Server 2016: DHCP. [Carpinteria, Calif.]: Lynda.com.
Mukhtar, H., Salah, K., & Iraqi, Y. (2012). Mitigation of DHCP starvation
attack. Computers & Electrical Engineering, 38(5), 1115-1128.
http://dx.doi.org/10.1016/j.compeleceng.2012.06.005
Park, S. (2016). A Rogue AP Detection Method Based on DHCP Snooping. Journal
Of Internet Computing And Services, 17(3), 11-18.
http://dx.doi.org/10.7472/jksii.2016.17.3.11
31

Radha, D., Jayaparvathy, R., Shanmughi, M., & Jothilakshmi, V. (2016). Data Mining
in DHCP Security. International Journal Of Computer Applications, 142(11), 6-17.
http://dx.doi.org/10.5120/ijca2016909566
Sridevi, S., & Dr.Manjaiah D.H, D. (2012). Security in Multicast DNS. International
Journal Of Scientific Research, 2(7), 88-90.
http://dx.doi.org/10.15373/22778179/july2013/30
Younes, O. (2016). A Secure DHCP Protocol to Mitigate LAN Attacks. Journal Of
Computer And Communications, 04(01), 39-50.
http://dx.doi.org/10.4236/jcc.2016.41005
Zhang, Y., & Xia, G. (2013). The SSL MIMT Attack with DNS Spoofing. Applied
Mechanics And Materials, 385-386, 1647-1650.
http://dx.doi.org/10.4028/www.scientific.net/amm.385-386.1647
Zheng, W. (2014). Seamless transition of domain name system (DNS) authoritative
servers. Scientific Research And Essays, 9(12), 566-570.
http://dx.doi.org/10.5897/sre2013.5741
32