[Autogenerated] In this module,
we'll be analyzing the traffic flow of DNS and taking a look at
one way an attacker might modify this flow.
Two concepts are important to understand first,
every client within an enterprise network won't be making external DNS queries.
Rather they make requests to the local DNS server or DNS resolver.
And it makes the external queries on their behalf.
The communication chain for the DNS resolve can involve up to three
other DNS servers to fully resolve any hostname.
The other concept to consider is caching before a client
even makes the request to a DNS server,
it will check the local browser and system cache.
First in general,
there are three locations DNS records are cache and it's
important to keep these locations secured.
First is the browser cache.
This is usually stored for a very short period of time.
If you've ever had a problem with a website that was fixed by closing
and reopening or browsing with an incognito tab,
the root issue probably had something to do with the page being cache.
Next is the operating system cache.
This module will be analyzing exactly how this one works.
Finally, we have the DNS server cache,
it doesn't make sense for a server to make hundreds of requests
when multiple users are visiting the same page.
So this efficiency is very helpful.
However, it still presents a security risk.