DNS Filters
DNS filters are typically one of the first defenses that we’ll need to consider
as penetration testers.
If we were to perform a DNS lookup from a target network,
that request might traverse through several
DNS servers inside the target environment,
eventually passing to a device that performs DNS filtering.
This may occur on the client’s network,
or the request may be forwarded to an
Internet-based DNS provider service, like OpenDNS.
At a basic level, most DNS filters compare requested domains to a blocklist of
well-known malicious domain names.
If the domain name is on the blocklist, it is filtered.
One of the better known open lists is malwaredomainlist.
Additionally, advanced systems may use advanced heuristics techniques as well.
If the requested domain is on the blocklist,
DNS filtering systems may drop the request or return a sinkhole, or fake, IP address.
A sinkhole IP will often either redirect to a block page,
which presents an error or warning to the user,
or to a monitoring device that captures further traffic,
which can be analyzed.
In some cases, it may simply be dropped.
Let’s demonstrate this process with an OpenDNS sinkhole.
OpenDNS maintains the www.internetbadguys.com test domain,
which is used to showcase their blocking service.
If we resolve this IP with OpenDNS’s server,
we should receive one of a variety of sinkhole IP addresses.
Let’s try this out from our Kali machine that has Internet access.
First, we’ll set our DNS server to Google.
Then we’ll resolve the domain name with nslookup.
This returns the public IP address instead of the sinkhole IP.
By extension, if we load www.internetbadguys.com in a browser,
we receive the following page:
If this were a real phishing site, we would have loaded it in our browser.
Now let’s switch to an OpenDNS server.
Next, we’ll try the lookup again.
This returns a different IP.
With our DNS server updated, let’s browse www.internetbadguys.com again.
This redirects to a block page,
categorized as an OpenDNS “Phishing threat”.
In addition to solutions like OpenDNS,
DNS servers can integrate domain reputation lookup solutions like IPVoid_,
and VirusTotal,
which query multiple DNS filtering providers,
aggregate the responses,
and make a weighted decision about reputability of the domain.
In addition to the simple suggestion to pass or block a domain,
many modern filtering systems rely on domain categorization,
similar to the “Phishing” diagnosis provided by OpenDNS
in our previous example.
For example, if an enterprise blocks users from accessing webmail
or movie-related domains,
we should avoid this categorization for our C2 server.
As a simple example,
let’s look up cnn.com with the OpenDNS categorization checker.
In this case, cnn.com is categorized as a “News/Media” site.
Armed with a basic understanding of DNS filters,
let’s shift our focus to bypass techniques.