Reverse DNS lookup is different than forward" DNS lookup
Reverse DNS: example.com \-> 12.345.678.910

Forward DNS: 12.345.678.910 -> nc1234.server.net

example.com is a website hosted into a VPS.

It has an A record pointing towards its IP.

nc1234.server.net display nothing but the logo of the hosting company.

It also has an A record pointing towards its IP.

What I am trying to understand is

1. Why and How the IP isn't forwarding me towards example.com but only towards nc1234.server.net ?

Thanks.
🗣Capeya92

I'm not understanding your use of "forward" and "reverse".

Generally speaking, DNS is used to lookup an IP address from a presented hostname. To do this, it does an 'A' (IPv4 Address) or 'AAAA' (IPv6 Address) request to a DNS server, that does the needful (either via recursion to the SOA for the domain, or via a cache of a previous SOA look-up that has not expired). An A/AAAA record can have multiple IP addresses associated with it.

A 'PTR' (Pointer) request is done to lookup a domain name for a given IP address. The same recursion/caching is used, except for PTR records, it does some Kung Fu on the IP address (reversing the octets) and sends it to "in-addr.arpa." domain. Unlike A records, a PTR record can only point to one Fully-Qualified Domain Name (FQDN).

The person who owns the in-addr.arpa. zone for a particular IP subnet isn't required to be (and rarely is) the same person who owns a domain name that points to that IP. That is, A <-> PTR are not tightly bound. A whole industry (IPAM - IP Address Management) has been created to solve that problem.

Complicating this are CNAME (Cannonical Name) records, which are FQDN's that point to other FQDN's. When you ask for an A/AAAA record, but the SOA for the domain only has a CNAME record for it, it will generally return the FQDN it points to, plus the A/AAAA record of the pointed-to FQDN.

TL;DR: PTR records (that do IP Address->FQDN) can only point to one FQDN. In this case, the subnet owner has pointed their PTR records for that IP to nc1234.server.net. Anyone can point A/AAAA/CNAME records at anything, which is why example.com resolves to the IP address.
👤Ottonym

The two records have no relationship to one another. The owner of a domain can point it to any IP she wishes. The owner of an IP can set the reverse record to any address they wish. Changing one has no effect on the other. Could be any number of reasons for the disparity, form different owners to sloppy records maintenance.
👤Benoit_In_Heaven


🎖@malwr

Researchers found that accelerometer data (collected by smartphone apps without user permission) can be used to infer parameters such as user height & weight, age & gender, tobacco and alcohol consumption, driving style, location, and more.
🗣bayashad

Overview of all information categories that can be inferred from accelerometer data: https://riot.weizenbaum-institut.de/blog/wp-content/uploads/2020/07/neu-diagramm.png
👤bayashad


🎖@malwr

Another Humble Bundle: Cybersecurity & Cryptography by Wiley


Every time they release two books that are on my list this saves me so much money. My hacking skills are gonna get so good
👤tdavetech


🎖@malwr

MITRE ATT&CK for Kubernetes: 4+1 Threat Vectors for the Defense Evasion Tactic
Read the whole article.

TL;DR

The defense evasion tactic consists of techniques that are used by attackers to avoid detection and stay under the radar by concealing any evidence of their presence.
Tactic #1: Clear container logs - deleting relevant logs from an application or an operating system that would record traces of an attacker’s activity. Mitigating Tactic #1 by limiting or denying completely the host mounts, and by using a real-time, automated analysis tool for Kubernetes audit logs.
Tactic #2: Deleting Kubernetes Events - Deleting these events reduces the risk of detecting security-related activities performed by the attacker. Mitigating Tactic #2 by configuring continuous audit logging and preferably exporting it to an external SIEM tool and the likes of it.
Tactics #3: Container name similarity - Attackers can create pods with a random suffix in their names, hiding the presence of unauthorized pods within a cluster. Mitigate Tactic #3 with Role-Based Access Control (RBAC) configurations, keeping the principle of least privilege.
Tactic #4: Connect from proxy server - Proxy servers and anonymous networks such as TOR are often used by attackers to hide their origin IP and initiate communication channels with applications or directly to the API server. Mitigate Tactic #4 by restricting network access to the Kubernetes API server and implementing proper firewall rules at the cloud provider level.
Bonus Tactic not in MITRE ATT&CK: DNS Resolution - A common practice for establishing covert channels is to exploit inherent weaknesses in the DNS protocol messages exchange. Monitor DNS activity within your Kubernetes cluster to detect and potentially prevent C2 channels from establishing covert channels.
🗣alcideio


🎖@malwr

Understanding "Solorigate"'s Identity IOCs
🗣Wireless_Life

The Solarwinds attack is an ongoing investigation, and teams at Microsoft continue to act as first responders to these attacks. The following post shares how they leverage threat intelligence and monitor for new indicators that could signal attacker activity.
👤Wireless_Life


🎖@malwr

🚨 CVE-2020-28641
In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.

🎖@cveNotify

DirectX creator Eric Engstrom dies aged 55, leaving behind a game-changing legacy
🗣instilledbee

According to wikipedia, he died from complications from dropping a monitor on his foot. Talk about unlucky. Damn.
👤turniphat


🎖@malwr

BlueTeam Online Training
I’m looking to have continuous training for a blue team and I’m curious as to what the group would recommend. Outside of Cybrary and SANS what do you recommend?

I’m personally interested in core disciplines and not aimed towards a certification. Also, being continuous is also helpful.
🗣nullsku

https://wildwesthackinfest.com/training-schedule/
👤Sho_nuff_

I haven’t used it but ISACA’s training looks solid. Was gonna try it before training budget was cut.

Maybe you can do a trial to see if you like it.

https://www.isaca.org/training-and-events/cybersecurity
👤Just_saying_brah


🎖@malwr

Reversing APT-28 64-bit Keylogger [Zebrocy Nim TLP: White ](https://0xthreatintel.medium.com/reversing-apt-28-64-bit-keylogger-zebrocy-nim-tlp-white-a77033f5c36b)
🗣digicat


🎖@malwr

Zelda Hit Detection - Behind the Code [YouTube](https://www.youtube.com/watch?v=FBk-QkzMeIk)
🗣rolfr


🎖@malwr