5353/UDP Multicast DNS (mDNS) and DNS-SD
Basic Information
Multicast DNS (mDNS) enables DNS-like operations within local networks without needing a traditional DNS server. It operates on UDP port 5353 and allows devices to discover each other and their services, commonly seen in various IoT devices. DNS Service Discovery (DNS-SD), often used alongside mDNS, aids in identifying services available on the network through standard DNS queries.
Operation of mDNS
In environments without a standard DNS server, mDNS allows devices to resolve domain names ending in .local by querying the multicast address 224.0.0.251 (IPv4) or FF02::FB (IPv6). Important aspects of mDNS include a Time-to-Live (TTL) value indicating record validity and a QU bit distinguishing between unicast and multicast queries. Security-wise, it's crucial for mDNS implementations to verify that the packet's source address aligns with the local subnet.
Functioning of DNS-SD
DNS-SD facilitates the discovery of network services by querying for pointer records (PTR) that map service types to their instances. Services are identified using a _<Service>._tcp or _<Service>._udp pattern within the .local domain, leading to the discovery of corresponding SRV and TXT records which provide detailed service information.
Network Exploration
nmap Usage
A useful command for scanning the local network for mDNS services is:
This command helps identify open mDNS ports and the services advertised over them.
Network Enumeration with Pholus
To actively send mDNS requests and capture traffic, the Pholus tool can be utilized as follows:
Attacks
Exploiting mDNS Probing
An attack vector involves sending spoofed responses to mDNS probes, suggesting that all potential names are already in use, thus hindering new devices from selecting a unique name. This can be executed using:
This technique effectively blocks new devices from registering their services on the network.
In summary, understanding the workings of mDNS and DNS-SD is crucial for network management and security. Tools like nmap and Pholus offer valuable insights into local network services, while awareness of potential vulnerabilities helps in safeguarding against attacks.
Spoofing/MitM
The most interesting attack you can perform over this service is to perform a MitM in the communication between the client and the real server. You might be able to obtain sensitive files (MitM the communication with the printer) of even credentials (Windows authentication). For more information check:
pageSpoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay AttacksReferences
Last updated