From sec-consult.com
In our previous DNS blog posts researched by Timo Longin, “Forgot password? Taking over user accounts Kaminsky style” and “Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style”, we’ve demonstrated how to identify DNS vulnerabilities in web applications and how to compromise even fully-patched WordPress instances via DNS attacks. However, finding DNS vulnerabilities isn’t a trivial task. Hence Timo Longin, security expert at SEC Consult, has developed and introduced the DNS Analysis Server, which allows fine-grained DNS analysis. Even though it’s a great tool, it requires the setup of a dedicated domain, a server and so on. Therefore, we’ve been looking for a better solution and – oh boy – we found it: A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications!