Attacks on DNS resources – DNS flooding, NX records, and subdomains

In this section, we will try to demonstrate various DNS Denial of Service (DOS) and Distributed Denial of Service (DDOS) attacks, in which an attacker sends DNS queries to increase a server’s utilization, or causes a service to respond late or never respond at all to connected users in a domain. This can be achieved with multiple levels of DNS attacks, such as DNS flooding, or with DNS amplification attacks.

NX record attacks

In this attack, the attacker will start sending fake (random) domain requests, pointing to the victim’s DNS domains, and hence the DNS resolver will start resolving the requests by generating DNS queries toward the victim’s DNS server.

Let’s try to understand this with the help of a small diagram, as shown in the following figure:

Figure 13.13 – A DOS attack on NX records

So, now we understand the NX record DOS attack...