SDBF: Smart DNS Brute-Forcer

Cynthia Wagner (1, 2) , Jérôme François (1, 2) , Radu State (1, 2) , Thomas Engel (1, 2) , Gérard Wagener (3) , Alexandre Dulaunoy (3)

1 Uni.lu - Université du Luxembourg
2 SnT - Interdisciplinary Centre for Security, Reliability and Trust [Luxembourg]
3 CIRCL - Computer Incident Response Center Luxembourg

The structure of the domain name is highly relevant for providing insights into the management, organization and operation of a given enterprise. Security assessment and network penetration testing are using information sourced from the DNS service in order to map the network, perform reconnaissance tasks, identify services and target individual hosts. Tracking the domain names used by popular Botnets is another major application that needs to undercover their underlying DNS structure. Current approaches for this purpose are limited to simplistic brute force scanning or reverse DNS, but these are unreliable. Brute force attacks depend of a huge list of known words and thus, will not work against unknown names, while reverse DNS is not always setup or properly configured. In this paper, we address the issue of fast and efficient generation of DNS names and describe practical experiences against real world large scale DNS names. Our approach is based on techniques derived from natural language modeling and leverage Markov Chain Models in order to build the first DNS scanner (SDBF) that is leveraging both, training and advanced language modeling approaches.

Mots clés: DNS; n-grams; security assessment; penetration testing

Domaines: Réseaux et télécommunications [cs.NI]

Cynthia Wagner, Jérôme François, Radu State, Thomas Engel, Gérard Wagener, et al.. SDBF: Smart DNS Brute-Forcer. Network Operations and Management Symposium, Apr 2012, Lahaina, United States. pp.1001 - 1007, ⟨10.1109/NOMS.2012.6212021⟩. ⟨hal-00748792⟩