DNS Analyzer - Burp Suite - Revision history

SGross: /* Step-by-Step Guide */

2024-12-11T19:58:21Z

Step-by-Step Guide

← Older revision		Revision as of 19:58, 11 December 2024
Line 63:		Line 63:
	<li>'''Install DNS Analyzer Extension:'''		<li>'''Install DNS Analyzer Extension:'''
	<ul>		<ul>
	<li>The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to '''Extensions > BApp Store''' ~~> DNS Analyzer~~.</li>		<li>The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to '''Extensions > BApp Store > DNS Analyzer'''.</li>
	</ul>		</ul>
	</li>		</li>

SGross: /* Step-by-Step Guide */

2024-12-11T19:58:06Z

Step-by-Step Guide

← Older revision		Revision as of 19:58, 11 December 2024
Line 63:		Line 63:
	<li>'''Install DNS Analyzer Extension:'''		<li>'''Install DNS Analyzer Extension:'''
	<ul>		<ul>
	<li>The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to Extensions > BApp Store > DNS Analyzer.</li>		<li>The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to '''Extensions > BApp Store''' > DNS Analyzer.</li>
	</ul>		</ul>
	</li>		</li>

SGross at 19:44, 11 December 2024

2024-12-11T19:44:29Z

← Older revision		Revision as of 19:44, 11 December 2024
Line 117:		Line 117:
	</li>		</li>
	</ul>		</ul>



	== References ==		== References ==
Line 127:		Line 125:

	Step-by-Step Guide Reference: https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27).		Step-by-Step Guide Reference: https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27).






	[[Category:Pentesting]]		[[Category:Pentesting]]

SGross: /* DNS Interaction Analysis: Process */

2024-12-11T19:44:02Z

DNS Interaction Analysis: Process

← Older revision		Revision as of 19:44, 11 December 2024
Line 18:		Line 18:

	<ol>		<ol>

	[[File:BurpSuite_DNSAnalyzer_Cycle.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]		[[File:BurpSuite_DNSAnalyzer_Cycle.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]

	<li>'''Initiate Domain Resolution:'''		<li>'''Initiate Domain Resolution:'''
	<ul>		<ul>

SGross: /* DNS Interaction Analysis: Process */

2024-12-11T19:43:45Z

DNS Interaction Analysis: Process

← Older revision		Revision as of 19:43, 11 December 2024
Line 17:		Line 17:
	== DNS Interaction Analysis: Process ==		== DNS Interaction Analysis: Process ==

			<ol>
	[[File:BurpSuite_DNSAnalyzer_Cycle.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]		[[File:BurpSuite_DNSAnalyzer_Cycle.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]

	~~<ol>~~
	<li>'''Initiate Domain Resolution:'''		<li>'''Initiate Domain Resolution:'''
	<ul>		<ul>

SGross at 19:42, 11 December 2024

2024-12-11T19:42:36Z

← Older revision		Revision as of 19:42, 11 December 2024
Line 112:		Line 112:
	<li>The UDP source port values show no static distribution, indicating randomness.</li>		<li>The UDP source port values show no static distribution, indicating randomness.</li>
	<li>The DNS ID values appear randomly distributed, with no observable clustering or predictability.</li>		<li>The DNS ID values appear randomly distributed, with no observable clustering or predictability.</li>
			[[File:Scatter_Plot_Analysis.png\|thumb\|none\|600px\|Scatter Plot Analysis <ref name="Author"/> ]]
	</ul>		</ul>
	</li>		</li>
	</ul>		</ul>

	~~[[File:Scatter_Plot_Analysis.png\|thumb\|none\|600px\|Scatter Plot Analysis <ref name="Author"/> ]]~~

	== References ==		== References ==

SGross at 19:41, 11 December 2024

2024-12-11T19:41:52Z

← Older revision		Revision as of 19:41, 11 December 2024
Line 69:		Line 69:
	<ul>		<ul>
	<li>Select "Copy to Clipboard" to generate and copy a new Collaborator domain.</li>		<li>Select "Copy to Clipboard" to generate and copy a new Collaborator domain.</li>
	[[File:~~Bild_2~~.png\|thumb\|none\|600px\|Generating a Collaborator Domain <ref name="Author"/>]]		[[File:Generating_a_Collaborator_Domain.png\|thumb\|none\|600px\|Generating a Collaborator Domain <ref name="Author"/>]]
	</ul>		</ul>
	</li>		</li>
Line 76:		Line 76:
	<ul>		<ul>
	<li>Initiate a DNS resolution for the generated domain. For example, register a user with the email address test@[your Collaborator domain] on the target web application.</li>		<li>Initiate a DNS resolution for the generated domain. For example, register a user with the email address test@[your Collaborator domain] on the target web application.</li>
	[[File:~~Bild_3~~.png\|thumb\|none\|600px\|Initiating DNS Resolution <ref name="Author"/>]]		[[File:Initiating_DNS_Resolution.png \|thumb\|none\|600px\|Initiating DNS Resolution <ref name="Author"/>]]
	</ul>		</ul>
	</li>		</li>
Line 83:		Line 83:
	<ul>		<ul>
	<li>The table will continue to fill up as more interactions occur. If necessary, initiate additional DNS resolutions to meet the analysis threshold of 20 interactions.</li>		<li>The table will continue to fill up as more interactions occur. If necessary, initiate additional DNS resolutions to meet the analysis threshold of 20 interactions.</li>
	[[File:~~Bild_4~~.png\|thumb\|none\|600px\|Monitoring Interactions <ref name="Author"/>]]		[[File:Monitoring_Interactions.png\|thumb\|none\|600px\|Monitoring Interactions <ref name="Author"/>]]
	</ul>		</ul>
	</li>		</li>
Line 90:		Line 90:
	<ul>		<ul>
	<li>Select a minimum of 20 interactions for analysis. The statistics and graphs will then be available for review in the results pane.</li>		<li>Select a minimum of 20 interactions for analysis. The statistics and graphs will then be available for review in the results pane.</li>
	[[File:~~Bild_4~~.png\|thumb\|none\|600px\|Analysis Results Pane <ref name="Author"/>]]		[[File:Analysis_Results_Pane.png\|thumb\|none\|600px\|Analysis Results Pane <ref name="Author"/>]]
	</ul>		</ul>
	</li>		</li>
Line 116:		Line 116:
	</ul>		</ul>

	[[File:~~Bild_5~~.png\|thumb\|none\|600px\|Scatter Plot Analysis <ref name="Author"/> ]]		[[File:Scatter_Plot_Analysis.png\|thumb\|none\|600px\|Scatter Plot Analysis <ref name="Author"/> ]]

	== References ==		== References ==

SGross: /* DNS Interaction Analysis: Process */

2024-12-11T19:31:21Z

DNS Interaction Analysis: Process

← Older revision		Revision as of 19:31, 11 December 2024
Line 17:		Line 17:
	== DNS Interaction Analysis: Process ==		== DNS Interaction Analysis: Process ==

	[[File:~~Bild_1~~.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]		[[File:BurpSuite_DNSAnalyzer_Cycle.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]

	<ol>		<ol>

SGross: /* WORK IN PROGRESS */

2024-12-11T19:16:31Z

WORK IN PROGRESS

← Older revision		Revision as of 19:16, 11 December 2024
Line 1:		Line 1:
	== ~~WORK IN PROGRESS~~ ==		== Introduction ==

	'''A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.'''		'''A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.'''
Line 14:		Line 14:

	Vulnerabilities arise when these elements are insufficiently random or predictable.		Vulnerabilities arise when these elements are insufficiently random or predictable.


	== DNS Interaction Analysis: Process ==		== DNS Interaction Analysis: Process ==

SGross: /* What Happens? */

2024-12-11T19:16:10Z

What Happens?

← Older revision		Revision as of 19:16, 11 December 2024
Line 16:		Line 16:


	== ~~What Happens?~~ ==		== DNS Interaction Analysis: Process ==

	[[File:Bild_1.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]		[[File:Bild_1.png\|thumb\|none\|600px\|Process of analyzing DNS interactions <ref name="Gross2024">Gross, Stella. (2024). Representations from [https://sec-consult.com/blog/detail/dns-analyzer-finding-dns-vulnerabilities-with-burp-suite/ (accessed on 11.12.2024, 12:27)] and accordingly adapted by the author Gross, Stella.</ref>]]