312-50 Question 197
Single answer▪ Sniffing Technique: DNS PoisoningDuring an internal security assessment, you are connected to the same switched subnet as several employee workstations. The client asks you to demonstrate the risk of DNS poisoning without modifying the organization’s upstream DNS servers. You first use ARP spoofing to position your system as a man-in-the-middle between a target workstation and the gateway. What is the most effective next step to redirect the victim from the legitimate payroll portal to a look-alike phishing site when the user browses by hostname?
- A
Intercept the victim’s DNS queries and send a forged DNS response with the attacker-controlled IP address before the legitimate DNS server replies
- B
Broadcast gratuitous ARP replies that map the payroll portal’s public hostname directly to the attacker’s MAC address
- C
Inject a fake HTTP 302 redirect into any outbound traffic so the browser updates its DNS cache with the phishing server’s IP address
- D
Modify the target’s NetBIOS name table so Windows resolves the payroll portal through NBNS instead of DNS
Show answer and explanation
Correct answer: A
Explanation
The best answer is to forge a DNS response after gaining man-in-the-middle position with ARP spoofing. In a practical CEH-style scenario, ARP spoofing is often used to intercept traffic on a switched LAN, and DNS poisoning is then used to manipulate hostname resolution by replying to a victim’s DNS request with a malicious IP before the legitimate resolver responds. This attack works because clients typically trust the first valid-looking DNS answer matching the outstanding query, then cache the result according to local resolver behavior and TTL values.
This question distinguishes DNS poisoning from related but different attacks. ARP poisoning helps intercept packets but does not resolve hostnames. HTTP redirection happens after DNS resolution and does not alter DNS cache entries. NBNS/LLMNR poisoning targets different Windows name resolution protocols and is generally relevant to local name spoofing rather than public or corporate FQDN web destinations.
From a defensive perspective, best practices include using DNSSEC where supported to authenticate DNS data, restricting or monitoring ARP spoofing with controls such as Dynamic ARP Inspection and port security, using encrypted DNS transport where appropriate, segmenting networks, and watching for duplicate or unexpected DNS responses. These principles align with common vendor and standards guidance, including DNS security recommendations from organizations such as CISA, NIST, and DNSSEC operational documentation from ICANN and IETF RFCs.
- A. Correct.
Correct. In a DNS poisoning scenario on a local network, once the attacker has man-in-the-middle visibility through ARP spoofing, the practical way to redirect a hostname-based request is to observe the victim’s DNS query and race the legitimate resolver with a spoofed DNS reply containing the attacker-controlled IP address. If the forged answer is accepted first and matches the query parameters, the victim will cache and use the malicious mapping. This reflects a realistic local DNS spoofing attack path commonly demonstrated in controlled assessments.
- B. Incorrect.
Incorrect. ARP operates at Layer 2 and maps IP addresses to MAC addresses; it does not map hostnames to MAC addresses. Gratuitous ARP can help poison ARP caches and maintain man-in-the-middle position, but it cannot directly associate a public DNS hostname such as a payroll portal with an attacker MAC address. This option reflects a common misconception between ARP poisoning and DNS poisoning.
- C. Incorrect.
Incorrect. An HTTP 302 redirect can redirect an already established HTTP request, but it does not update DNS records in the browser or OS resolver cache. Also, if the target site uses HTTPS, injecting a usable redirect becomes more difficult without triggering certificate warnings or breaking the TLS session. The scenario specifically asks for redirecting the victim when browsing by hostname through DNS poisoning, which is done at the name resolution stage, not by altering DNS via HTTP behavior.
- D. Incorrect.
Incorrect. NetBIOS Name Service (NBNS) applies to legacy Windows name resolution for NetBIOS names on local networks, not normal resolution of Internet-style fully qualified domain names such as a payroll portal. Modern access to corporate or Internet web portals is resolved through DNS, so modifying the NetBIOS name table would not be the most effective method here. This distractor targets confusion between NBNS/LLMNR poisoning and DNS poisoning.