'''A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.'''
A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.
'''Short rundown on what the Kaminsky attack is:'''
Short rundown on what the Kaminsky attack is:
DNS cache poisoning involves injecting fake responses into a resolver's cache, redirecting users to malicious sites. In 2008, Dan Kaminsky exposed a flaw where static source ports and predictable transaction IDs made such attacks easier. Modern systems now randomize these elements, requiring attackers to guess 32 bits, making successful attacks far more challenging.<ref name="Kaminsky2008">Dan Kaminsky. (2008). Black ops 2008: It’s the end of the cache as we know it. In Black Hat USA Conference. IOActive, Inc. Presented at Black Hat USA 2008.</ref>
DNS cache poisoning involves injecting fake responses into a resolver's cache, redirecting users to malicious sites. In 2008, Dan Kaminsky exposed a flaw where static source ports and predictable transaction IDs made such attacks easier. Modern systems now randomize these elements, requiring attackers to guess 32 bits, making successful attacks far more challenging.<ref name="Kaminsky2008">Dan Kaminsky. (2008). Black ops 2008: It’s the end of the cache as we know it. In Black Hat USA Conference. IOActive, Inc. Presented at Black Hat USA 2008.</ref>
This extension checks the randomness of:
'''This extension checks the randomness of:'''
<ul>
<li><b>UDP Source Port:</b> Evaluates the randomness of source port values.</li>
<li><b>DNS Transaction ID:</b> Measures the predictability of transaction IDs.</li>
</ul>
UDP Source Port
DNS Transaction ID
Vulnerabilities arise when these elements are insufficiently random or predictable.
Vulnerabilities arise when these elements are insufficiently random or predictable.
What happens behind the scene:
== What Happens? ==
(bild einfügen)
Initiate Domain Resolution: The web application is forced to resolve a generated domain (e.g., 334jk47xssn7.oastify.com).
DNS Query: The web application sends a query to the configured DNS resolver.
Burp Collaborator: Logs the DNS query and returns an unmodified response.
Analysis: Results are evaluated within the DNS Analyzer extension.
Additional Tests: Can be triggered through actions like registration, password resets, or newsletter sign-ups.
Requirement: A Burp Suite Professional license.
[[File:Bild_1.png|thumb|none|600px|Ablauf]]
Step-by-Step Guide
<ol>
<li>'''Initiate Domain Resolution:'''
<ul>
<li>The web application is forced to resolve a generated domain (e.g., 334jk47xssn7.oastify.com).</li>
</ul>
</li>
The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite.
<li>'''DNS Query:'''
Navigate to Extensions > BApp Store > DNS Analyzer.
<ul>
<li>The web application sends a query to the configured DNS resolver.</li>
</li>
</ul>
</li>
1. Select "Copy to Clipboard" to generate and copy a new Collaborator domain.
<li>'''Burp Collaborator:'''
<ul>
<li>Logs the DNS query and returns an unmodified response.</li>
</li>
</ul>
</li>
(Bild 2)
<li>'''Analysis'''
<ul>
<li>Results are evaluated within the DNS Analyzer extension.</li>
</li>
</ul>
</li>
2. Initiate a DNS resolution for the generated domain. For instance, register a user with the email address test@[your Collaborator domain] on the target web application.
<li>'''Additional Tests'''
<ul>
<li>Can be triggered through actions like registration, password resets, or newsletter sign-ups.</li>
</li>
</ul>
</li>
</ol>
(Bild 3)
Requirement: A Burp Suite Professional license.
3. The table will continue to fill up as more interactions occur. If necessary, initiate additional DNS resolutions to meet the analysis threshold of 20 interactions.
== Step-by-Step Guide ==
(Bild 4)
<ol>
<li>'''Install DNS Analyzer Extension:'''
<ul>
<li>The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to Extensions > BApp Store > DNS Analyzer.</li>
</ul>
</li>
<li>'''Generate Collaborator Domain:'''
<ul>
<li>Select "Copy to Clipboard" to generate and copy a new Collaborator domain.</li>
[[File:Bild_2.png|thumb|none|600px|Generating a Collaborator Domain]]
</ul>
</li>
4. Select a minimum of 20 interactions for analysis. The statistics and graphs will then be available for review in the results pane.
<li>'''Initiate DNS Resolution:'''
<ul>
<li>Initiate a DNS resolution for the generated domain. For example, register a user with the email address test@[your Collaborator domain] on the target web application.</li>
[[File:Bild_3.png|thumb|none|600px|Initiating DNS Resolution]]
</ul>
</li>
<li>'''Monitor Interactions:'''
<ul>
<li>The table will continue to fill up as more interactions occur. If necessary, initiate additional DNS resolutions to meet the analysis threshold of 20 interactions.</li>
he Kaminsky status is automatically generated by the DNS Analyzer after selecting 20+ interactions, categorizing results as POOR, GOOD, or GREAT based on metrics like:
== Analysis and Interpretation ==
Standard deviation: Measures distribution spread for source ports and DNS IDs.
'''Kaminsky status:'''
Direction bias: Detects upward/downward trends in distributions.
Port difference (bits): Compares the range of ports/IDs.
While these metrics provide a quick overview, scatter plots offer visual insights for identifying patterns machines might miss.
For instance, examining the two scatter plots below reveals no discernible patterns or predictability in the source port or DNS ID values.
The Kaminsky status is automatically generated by the DNS Analyzer after selecting 20+ interactions, categorizing results as POOR, GOOD, or GREAT based on metrics like:
* '''Standard deviation:''' Measures the spread of distribution for source ports and DNS IDs.
* '''Direction bias:''' Detects trends (upward or downward) in the distributions.
* '''Port difference (bits):''' Compares the range of source ports and DNS IDs.
The UDP source port values show no static distribution, and the DNS ID values are randomly distributed.
'''Scatter plots:'''
<ul>
<li><b>Visual insights:</b> Scatter plots provide additional insights, enabling identification of patterns that automated analysis might miss.</li>
A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.
Short rundown on what the Kaminsky attack is:
DNS cache poisoning involves injecting fake responses into a resolver's cache, redirecting users to malicious sites. In 2008, Dan Kaminsky exposed a flaw where static source ports and predictable transaction IDs made such attacks easier. Modern systems now randomize these elements, requiring attackers to guess 32 bits, making successful attacks far more challenging.[1]
This extension checks the randomness of:
UDP Source Port: Evaluates the randomness of source port values.
DNS Transaction ID: Measures the predictability of transaction IDs.
Vulnerabilities arise when these elements are insufficiently random or predictable.
The web application is forced to resolve a generated domain (e.g., 334jk47xssn7.oastify.com).
DNS Query:
The web application sends a query to the configured DNS resolver.
Burp Collaborator:
Logs the DNS query and returns an unmodified response.
Analysis
Results are evaluated within the DNS Analyzer extension.
Additional Tests
Can be triggered through actions like registration, password resets, or newsletter sign-ups.
Requirement: A Burp Suite Professional license.
Step-by-Step Guide
Install DNS Analyzer Extension:
The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to Extensions > BApp Store > DNS Analyzer.
Generate Collaborator Domain:
Select "Copy to Clipboard" to generate and copy a new Collaborator domain.
Initiate a DNS resolution for the generated domain. For example, register a user with the email address test@[your Collaborator domain] on the target web application.
The table will continue to fill up as more interactions occur. If necessary, initiate additional DNS resolutions to meet the analysis threshold of 20 interactions.
The Kaminsky status is automatically generated by the DNS Analyzer after selecting 20+ interactions, categorizing results as POOR, GOOD, or GREAT based on metrics like:
Standard deviation: Measures the spread of distribution for source ports and DNS IDs.
Direction bias: Detects trends (upward or downward) in the distributions.
Port difference (bits): Compares the range of source ports and DNS IDs.
Scatter plots:
Visual insights: Scatter plots provide additional insights, enabling identification of patterns that automated analysis might miss.
Example:
The UDP source port values show no static distribution, indicating randomness.
The DNS ID values appear randomly distributed, with no observable clustering or predictability.
↑Dan Kaminsky. (2008). Black ops 2008: It’s the end of the cache as we know it. In Black Hat USA Conference. IOActive, Inc. Presented at Black Hat USA 2008.
Cite error: <ref> tag with name "Author" defined in <references> is not used in prior text.
Step-by-Step Guide Reference: Inspired by Sec-Consult's blog post on DNS Analyzer: Finding DNS Vulnerabilities with Burp Suite (accessed on 11.12.2024, 12:27).
