DNS:
Exploitation
DNS exploitation guides covering poisoning, takeover, and hijacking
ADIDNS Poisoning and Hijacking
Exploit Active Directory DNS zones by injecting wildcard records and hijacking ADIDNS to redirect traffic or capture credentials in AD environments.
WPAD DNS Credential Capture with Responder
Exploit WPAD misconfiguration using Responder to poison DNS, intercept proxy auto-discovery requests, and capture NTLMv2 credentials from Windows hosts.
DNS exploitation uses confirmed DNS weaknesses to redirect traffic, inject records, or poison resolver caches. These attacks manipulate name resolution to intercept authentication, redirect users, or stage man-in-the-middle positions.
Zone transfer abuse extracts the full zone for intelligence gathering and identifies targets for further attacks. DNS cache poisoning injects forged responses into a resolver's cache, redirecting legitimate queries to attacker-controlled infrastructure. Dynamic update injection, when nsupdate is accepted without authentication, lets you add or modify DNS records directly.