Comments on: WhiteHat Security releases free tool to monitor DNS hijackings

By: Ankit Gupta

Ankit Gupta — Wed, 04 Mar 2015 11:36:00 +0000

In reply to hackerman1. Hi, Yes, its for UNIX operating system and the tool can be run out of cron. At times we do cover Non-Windows news which could be beneficial for the visitors.

By: Ankit Gupta

Ankit Gupta — Wed, 04 Mar 2015 11:33:00 +0000

In reply to JWC. Hi, Thanks for your suggestion. Currently we have covered only the release of the tool. I request you to visit the site for more information. Also, if we review this, I will surely get back to you on "how to install" and so on. Thanks

By: Dan

Dan — Wed, 04 Mar 2015 04:43:00 +0000

It’s tricky to get this one to work under Cygwin with Windows, so I hope this may help those who could use an easier way in their circumstance. This is important as even when tracerts et al say you’re reaching Google’s dns server (e.g.), it’s recently been found some ISPs are managing to hijack port 53 at router/modem level and re-direct to their own hosted versions…so could anyone able to do such hack.

One simple way Windows users can with fair accuracy confirm/deny DNS hijack even if very low level: open a command prompt (don’t need elevation), and type: nslookup -type=txt which.opendns.com. 208.67.220.220 , hit “enter”; if in the results you see “I am not an OpenDNS server”, you’re being hijacked…if you see some number, with decimal point followed by “aaa” (example: 5.aaa), you’re not being hijacked.

Almost as good is this test, for both TCP and UDP, again via command prompt: testing TCP, type nslookup, hit enter, and to test UDP next type: server dnstest.nnsquad.org, hit enter, and regardless of result type control.hq ; hit enter, and proceed to test TCP by typing next: Is -d control.hq, hit enter; now compare the ip address you got for UDP and TCP here; if they match, likely no hijack, if they’re different, booyah, hijacked. (If your version of Windows, e.g. 7 Home Premium, doesn’t recognize the “Is” command, instead of ‘Is’ for TCP, type: set type=axfr, hit enter, then type control.hq, hit enter).

Hope some can find these alternative dns checkers useful, cheers!

By: hackerman1

hackerman1 — Wed, 04 Mar 2015 03:49:00 +0000

Are you sure that this is for Windows ?
Have posted this on the right webbsite ?
It seems to be for Linux / Unix….

By: JWC

JWC — Wed, 04 Mar 2015 03:37:00 +0000

Ankit,

It sounds like a great program.
However, it would be very helpful if some screen shots and more of an explanation of exactly how to set up and use the program.
E.G, Like this: Make sure you use tabs to delimit the strings.
and the other lines of text like that.
Without more explanation many followers will not be able to install and use the program.

I hope you can help and keep up the great coverage.\