ADIDNS Revisited – WPAD, GQBL, and More

Kevin Robertson argues ADIDNS beats LLMNR/NBNS spoofing for MITM attacks in AD environments: attackers with unprivileged access can add wildcard records that intercept name resolution domain-wide.

Bishop Fox scanned the Alexa top million domains and found 98% vulnerable to email spoofing; only 2% combined SPF with strict DKIM. The free SpoofCheck tool diagnoses missing defenses.

Asks whether DNS cache poisoning still matters: explains how the classic attack works, why confirmed major incidents have all but vanished, and where the technique remains exploitable.

Most public guides to disabling WPAD, including Microsoft's, are incorrect; after the author reported this to MSRC, Microsoft updated its documentation. Covers the two registry keys and GPOs needed.

Kubernetes CVE-2020-8554 is a design-level MitM flaw affecting all versions and unpatchable: tenants with routing control can intercept other tenants' traffic, a multi-tenant isolation lesson.

Analyzes leftover domain-validation TXT records across a million domains to fingerprint the online service providers a company uses, releasing a PowerShell script to automate the reconnaissance.