5353/UDP Multicast DNS (mDNS) and DNS-SD
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Multicast DNS (mDNS) enables DNS-like operations within local networks without needing a traditional DNS server. It operates on UDP port 5353 and allows devices to discover each other and their services, commonly seen in various IoT devices. DNS Service Discovery (DNS-SD), often used alongside mDNS, aids in identifying services available on the network through standard DNS queries.
In environments without a standard DNS server, mDNS allows devices to resolve domain names ending in .local by querying the multicast address 224.0.0.251 (IPv4) or FF02::FB (IPv6). Important aspects of mDNS include a Time-to-Live (TTL) value indicating record validity and a QU bit distinguishing between unicast and multicast queries. Security-wise, it's crucial for mDNS implementations to verify that the packet's source address aligns with the local subnet.
DNS-SD facilitates the discovery of network services by querying for pointer records (PTR) that map service types to their instances. Services are identified using a _<Service>._tcp or _<Service>._udp pattern within the .local domain, leading to the discovery of corresponding SRV and TXT records which provide detailed service information.
A useful command for scanning the local network for mDNS services is:
This command helps identify open mDNS ports and the services advertised over them.
To actively send mDNS requests and capture traffic, the Pholus tool can be utilized as follows:
An attack vector involves sending spoofed responses to mDNS probes, suggesting that all potential names are already in use, thus hindering new devices from selecting a unique name. This can be executed using:
This technique effectively blocks new devices from registering their services on the network.
In summary, understanding the workings of mDNS and DNS-SD is crucial for network management and security. Tools like nmap and Pholus offer valuable insights into local network services, while awareness of potential vulnerabilities helps in safeguarding against attacks.
The most interesting attack you can perform over this service is to perform a MitM in the communication between the client and the real server. You might be able to obtain sensitive files (MitM the communication with the printer) of even credentials (Windows authentication). For more information check:
Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay AttacksLearn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
