Domain Names and DNS Concepts

Whois

• Provides info about domain name registrant
• The registrant is the legal owner of the domain

Domain Names

• A domain is a logical region of the Internet.
• Domain names consist of one or more parts separated by periods, eg. “singaporetech.edu.sg”.
• Top-Level Domain (TLD) name – rightmost portion of the domain name, eg. “.sg”
• A Second-Level Domain (SLD) – next portion of a domain name (right to left), eg. “.org”.

Domain Name System (DNS)

• Each computer is assigned a unique IP address.
• A hostname is an alias for the IP address, e.g. “SIT-NB-X220-456”.
• When entering a domain name into a browser, name servers provide the IP address of the domain web server to the browser.

DNSSEC

• Domain Name System Security Extensions
• Prevents cache poisoning and man-in-the-middle (MITM) attacks

ICANN

• Internet Corporation for Assigned Names and Numbers
• In 2011, unauthorized persons gained access to usernames, email addresses, and encrypted passwords for profile accounts on ICANN.org website.
• Leaked info included harmless information such as user preferences, public biographies, interests, newsletters, and subscriptions.

Reconnaissance Techniques and Tools

• DNS Data View: Extracts DNS records (MX, NS, A, SOA)
• nslookup (also try dig): Queries internet name servers interactively. Translates domain name to IP address or vice versa.

Netcraft

- Provides internet security and data mining services.
- Can be used to footprint a website.
- Provides: Domain name owner, E-mail addresses, Name servers, Names and contact info of admin, technical staff.

BuiltWith

• Provides information about the technology used to build a website, such as programming languages, frameworks, and libraries.

Social Engineering Attacks

• Attacks that exploit human psychology to manipulate and trick victims into divulging sensitive information or granting unauthorized access.
• Types of attacks:
  • Pretexting: attacker creates a false sense of trust e.g., sympathy, appeal to empathy.
  • Baiting: Enticement used to obtain login credentials e.g., free game download.
  • Quid Pro Quo: Promise of a benefit in exchange for a service.
  • Tailgating (Piggybacking): Attackers follow authorized individuals into restricted areas without proper authentication.

Social Engineering Skills

• Hackers must be able to use charm and influence to manipulate.
• They must be able to build up insider knowledge and trust relationships.
• Attackers may spend days to complete a hack:
  • Learning internal company lingo and culture.
  • Developing connections with key people - security personnel and IT system support staff.

Techniques and Tools for Social Engineering Attacks

• Calls to employees:
  • Call help desk as a new employee for help with a particular task.
  • Angry manager calls lower-level system admin because password has suddenly stopped working.
  • System admin calls employee to fix her account...passwd filetype:txt (no space after :).

Google Hacking

• Uses advanced Google search operators to find sensitive or hidden information that is not readily available on a website.
• Google Dorking:
  • Info retrieved not for public.
  • Info available because not adequately secured.
• Google Hacking Database (GHDB):
  • https://www.exploit-db.com/
  • https://www.exploit-db.com/google-hacking-database/

Google Hacking Examples

• Example 1: "Some logins can be bypassed with SQLI"
• Example 2: "What is ext?"
• Example 3: "ext:txt inurl:passwd, ext:txt inurl:password, ext:csv inurl:passwd, ext:xlsx inurl:password"
• Example 4: "intitle:index.of.accounts"
• Example 5: Google Cache - https://webcache.googleusercontent.com/search?q=cache:h_HPg1aUUX4J:https://www.straitstimes.com/&cd=2&hl=en&ct=clnk&gl=sg

Google Cache

• Why use it:
  • Signatures (forgery)
  • Financial information

Shodan

• Search engine for Internet-connected devices.
• https://www.shodan.io/

Defences Against Google Hacking

• Use Google hacking techniques to uncover your own security problems.
• Proper configuration for web-based devices:
  • Use strong authentication not defaults.
• Have a good corporate security policy: e.g., policy for asset protection.
• Educate users about best practices.
• Use robots.txt so Web pages not indexed, but this can also signal sensitive data to attackers.

Spam

• Unsolicited bulk emails (e.g., phishing, malware)

Doxing

• Gathering or deducing information about someone using internet sources.
• “Document Tracing”
• Info could include name, age, email, address, telephone number, photographs etc.
• Used for different reasons e.g., who hacked my camera?, is person X masquerading as person Y?

Test your knowledge on domain names, their components, and the Domain Name System (DNS). This quiz covers topics such as Whois information, top-level domains, and DNS security measures like DNSSEC. Dive into the fundamentals of how domains work in the internet ecosystem.