computing:dnshijack
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:dnshijack [2026/09/06 01:25] – oemb1905 | computing:dnshijack [2026/09/06 02:07] (current) – removed oemb1905 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ------------------------------------------- | ||
| - | * **dnshijack** | ||
| - | * **Jonathan Haack** | ||
| - | * **Haack' | ||
| - | * **webmaster@haacksnetworking.org** | ||
| - | ------------------------------------------- | ||
| - | |||
| - | //DNS Hijack// | ||
| - | |||
| - | ------------------------------------------- | ||
| - | |||
| - | Let's make sure wyze is not leaking ... after dropping all 443 853 to DoH and hijacking all udp53 and sending it back to the pihole: | ||
| - | |||
| - | tcpdump -ni eth1 udp port 53 and '( host 8.8.8.8 or host 8.8.4.4 or host 1.1.1.1 or host 1.0.0.1 or host 9.9.9.9 )' | ||
| - | tcpdump -ni eth1 '(tcp port 443 or tcp port 853 or udp port 853)' and '(host 8.8.8.8 or host 8.8.4.4 or host 1.1.1.1 or host 1.0.0.1 or host 9.9.9.9 )' | ||
| - | tcpdump -ni eth1 ip6 and udp port 53 and '( host 2001: | ||
| - | tcpdump -ni eth1 ip6 and '(tcp port 443 or tcp port 853 or udp port 853)' and '( host 2001: | ||
| - | |||
| - | Or, run all at once: | ||
| - | < | ||
| - | tcpdump -ni eth1 ' | ||
| - | ( | ||
| - | udp port 53 or | ||
| - | tcp port 443 or | ||
| - | tcp port 853 or | ||
| - | udp port 853 | ||
| - | ) and ( | ||
| - | host 8.8.8.8 or host 8.8.4.4 or | ||
| - | host 1.1.1.1 or host 1.0.0.1 or | ||
| - | host 9.9.9.9 or | ||
| - | host 2001: | ||
| - | host 2606: | ||
| - | host 2620:fe::fe | ||
| - | ) | ||
| - | ' | ||
| - | </ | ||
| - | |||
| - | Or, to just check the cameras (use static ips on the restricted zone) traffic in entirety: | ||
| - | |||
| - | |||
| - | tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | ||
| - | |||
| - | Or, just check outbound 53 / 853, direct udp: | ||
| - | |||
| - | tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep '(\.53 |\.853 )' | ||
| - | | ||
| - | Or, check 443 and 853 while stripping the okay stun/turn they need for the app: | ||
| - | |||
| - | tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep -v ' | ||
| - | |||
| - | --- // | ||
computing/dnshijack.1788657944.txt.gz · Last modified: by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
