MoinQ: DNS/Cloudflare/ゾーン作成/tcpreplay.net/同居

DNS/Cloudflare/tcpreplay.net/同居について、ここに記述してください。

tcpreplay.net.          172800  IN      NS      ns1.tcpreplay.net.
ns1.tcpreplay.net.      172800  IN      A       52.213.198.181

$ dig -t txt cf1111.tcpreplay.net @52.213.198.181

cf1111.tcpreplay.net.   300     IN      NS      ns-out.out.117yen.com.
ns-out.out.117yen.com.  170     IN      A       63.35.157.66

• 毒入返答 (cf1111のNSが狙われる)

watchA/117yen.com

偽のout.117yen.comが同居させられたら。

$ dig -t ns out.117yen.com @52.213.198.181
out.117yen.com.         170     IN      NS      ns.out.117yen.com.
ns.out.117yen.com.      170     IN      A       52.213.198.181

$ dig out.117yen.com @52.213.198.181

; <<>> DiG 9.16.1-Ubuntu <<>> out.117yen.com @52.213.198.181
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45172
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: af03f1af1705487f47ec47d75f40704a5794277e26e9560a (good)
;; QUESTION SECTION:
;out.117yen.com.                        IN      A

;; AUTHORITY SECTION:
out.117yen.com.         17      IN      SOA     ns.out.117yen.com. root.out.117yen.com. 17 1717 1717 1717 17

;; Query time: 255 msec
;; SERVER: 52.213.198.181#53(52.213.198.181)
;; WHEN: 土  8月 22 10:09:30 JST 2020
;; MSG SIZE  rcvd: 115