# Exploitation

> DNS exploitation guides covering poisoning, takeover, and hijacking

- **URL:** https://hackindex.io/services/dns/exploitation
- **Service:** [DNS](https://hackindex.io/services/dns.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-11
- **Updated:** 2026-03-29

DNS exploitation uses confirmed DNS weaknesses to redirect traffic, inject records, or poison resolver caches. These attacks manipulate name resolution to intercept authentication, redirect users, or stage man-in-the-middle positions.

Zone transfer abuse extracts the full zone for intelligence gathering and identifies targets for further attacks. DNS cache poisoning injects forged responses into a resolver's cache, redirecting legitimate queries to attacker-controlled infrastructure. Dynamic update injection, when nsupdate is accepted without authentication, lets you add or modify DNS records directly.

## Guides

- [ADIDNS Poisoning and Hijacking](https://hackindex.io/services/dns/exploitation/adidns-poisoning-and-hijacking.md): Exploit Active Directory DNS zones by injecting wildcard records and hijacking ADIDNS to redirect traffic or capture credentials in AD environments.
- [DNS Cache Poisoning and Spoofing](https://hackindex.io/services/dns/exploitation/dns-cache-poisoning-and-spoofing.md)
- [DNS Rebinding – Bypass SOP to Reach Internal Services](https://hackindex.io/services/dns/exploitation/dns-rebinding.md)
- [Insecure DNS Dynamic Updates (RFC 2136)](https://hackindex.io/services/dns/exploitation/insecure-dynamic-updates.md)
- [Subdomain Takeover Exploitation](https://hackindex.io/services/dns/exploitation/subdomain-takeover-exploitation.md)
- [TSIG Key Abuse – Authenticated DNS Zone Manipulation](https://hackindex.io/services/dns/exploitation/tsig-key-abuse-authenticated-dns-zone-manipulation.md)
- [WPAD DNS Credential Capture with Responder](https://hackindex.io/services/dns/exploitation/wpad-dns-credential-capture-with-responder.md): Exploit WPAD misconfiguration using Responder to poison DNS, intercept proxy auto-discovery requests, and capture NTLMv2 credentials from Windows hosts.