DNS Analyzer - Burp Suite
WORK IN PROGRESS
A Burp Suite plugin for identifying DNS resolvers vulnerable to Kaminsky attacks in web applications.
Short rundown on what the Kaminsky attack is:
DNS cache poisoning involves injecting fake responses into a resolver's cache, redirecting users to malicious sites. In 2008, Dan Kaminsky exposed a flaw where static source ports and predictable transaction IDs made such attacks easier. Modern systems now randomize these elements, requiring attackers to guess 32 bits, making successful attacks far more challenging.[1]
This extension checks the randomness of:
UDP Source Port DNS Transaction ID Vulnerabilities arise when these elements are insufficiently random or predictable.
What happens behind the scene:
(bild einfügen)
Initiate Domain Resolution: The web application is forced to resolve a generated domain (e.g., 334jk47xssn7.oastify.com). DNS Query: The web application sends a query to the configured DNS resolver. Burp Collaborator: Logs the DNS query and returns an unmodified response. Analysis: Results are evaluated within the DNS Analyzer extension. Additional Tests: Can be triggered through actions like registration, password resets, or newsletter sign-ups. Requirement: A Burp Suite Professional license.
Step-by-Step Guide
The DNS Analyzer extension is available for installation directly from the BApp Store in Burp Suite. Navigate to Extensions > BApp Store > DNS Analyzer.
1. Select "Copy to Clipboard" to generate and copy a new Collaborator domain.
(Bild 2)
- ↑ Dan Kaminsky. (2008). Black ops 2008: It’s the end of the cache as we know it. In Black Hat USA Conference. IOActive, Inc. Presented at Black Hat USA 2008.