DNS Spoofing: Redirecting Network Traffic

DNS spoofing, or cache poisoning, involves corrupting a DNS resolver's cache with a forged IP address, redirecting users from a legitimate website to a malicious one controlled by the attacker.

How DNS Resolution Works

DNS translates human-readable domain names into IP addresses.

When a user queries a domain, a DNS resolver checks its cache and, if not found, queries authoritative servers.

Poisoning the Cache

An attacker floods a DNS resolver with forged responses before the legitimate authoritative server can reply.

If the attacker guesses the transaction ID correctly, the resolver caches the malicious IP address.

Impact of DNS Spoofing

Users attempting to visit legitimate sites (like a bank) are silently redirected to a phishing page.

This attack is particularly dangerous because the URL in the browser appears correct.

PenTest+ Preparation

You will need to understand the mechanisms of DNS spoofing and how it fits into broader network attacks.

We highly recommend using Cert Sensei for realistic practice questions to prep for the exam.

❓ Frequently Asked Questions