This is the README documentation for the DNS Security Lab, produced and maintained by CodePath.org.
Want to jump into the lab? Navigate to the Part 0 Instructions to get started!
The DNS Security Lab is designed to teach you how the internet's naming system really works — and how attackers abuse it. You'll start by resolving names by hand with dig to see why your computer trusts whatever answer its resolver hands back. Then you'll weaponize that trust: poison a resolver so a bank's login page points at a server you control, stand up a lookalike page, and capture a victim's credential. Finally you'll flip to defender and hunt through DNS query logs to find data an attacker smuggled out over DNS. Real DNS exploitation and real DNS defense, both in one container.
- Read the DNS records (
A,CNAME,TXT) that turn a name into an IP, and explain why a client trusts its resolver's answer - Poison a resolver by editing its config so a trusted domain points at a host you control
- Harvest a credential by serving a lookalike login page at the victim's expected address and capturing what they submit
- Hunt an attack after the fact — spot the DNS redirect and recover data exfiltrated over DNS
- Setup: Run the lab environment with Docker
- Learn: How DNS Really Works
- Apply: The Hijack
- Challenge: The Hunt
In the provided Docker container, you will find all the necessary tools and dependencies pre-installed. This includes:
digandnslookup- for querying DNS records by hand- A local resolver (
dnsmasq) - the resolver you'll poison curl- to request pages through the poisoned resolver- A lookalike login page and capture server - the phishing site you'll stand up
- DNS query logs - the evidence you'll hunt through in Part 3
Part 3 also uses CyberChef (in your browser) to decode the exfiltrated data.