Need help with analysis of DNS queries

[Mohakim888]

3
dnschanger_queries_export.txt
Hi i recently tapped into the world of coding and it's a real journey to navigate for someone coming from a healthcare background 🤓

It's baby steps I'm making but I'm stuck on the networking vulnerabilities module

We've been asked to look at our own DNS QUERIES and identify a potential tracker/cookie/"bad ad" and i honestly don't know where to start

Is there a tool to run this through? Or can someone take a look and gimme a shout on a tip or two?

Thanks guys

[sachasa]

Understanding and analyzing DNS queries for potential trackers, cookies, or malicious activity can be a complex task, especially for someone new to networking and security concepts. Here are some steps and tools you can use to get started:

Wireshark:
Wireshark is a powerful network protocol analyzer that allows you to capture and interactively browse the traffic running on a computer network. You can use Wireshark to capture DNS queries and analyze them for potential trackers or malicious activity.

Capturing DNS Traffic:
Start Wireshark and begin capturing traffic on your network interface. You can filter the captured traffic to focus specifically on DNS queries. Use the filter expression udp.port == 53 to display only DNS traffic.

Analyzing DNS Queries:
Look for DNS queries that seem suspicious or unusual. Pay attention to the domain names being queried. Look for patterns such as frequent queries to tracking domains or domains associated with known ad networks.

Researching Domain Names:
Once you've identified suspicious domain names, you can research them to determine if they are associated with trackers, cookies, or malicious activity. You can use online tools like VirusTotal, DomainTools, or even a simple web search to gather more information about the domains.

Blocking or Investigating:
Depending on your findings, you may choose to block access to the suspicious domains at your network's firewall or DNS level. Alternatively, you may investigate further to determine the source of the DNS queries and take appropriate action to mitigate any potential threats.

Remember, analyzing DNS queries for potential trackers or malicious activity requires some knowledge of networking and security concepts. It's essential to approach the task with curiosity and a willingness to learn. Don't hesitate to reach out to online communities, forums, or security professionals for guidance and assistance as you navigate through this process.