To have the target Windows DNS Server parse responses from our malicious DNS NameServer, we do the following:
Configure our domain’s (
deadbeef.fun) NS Records to point at our malicious DNS Server (
ns1.41414141.club).
Query the victim Windows DNS Server for NS Records of
deadbeef.fun.
The victim DNS, not yet knowing the answer for this query, forwards the query to the DNS server above it (
8.8.8.8).
The authoritative server (
8.8.8.8) knows the answer, and responds that the NameServer of
deadbeef.fun is
ns1.41414141.club.
The victim Windows DNS Server processes and caches this response.
The next time we query for a subdomain of
deadbeef.fun, the target Windows DNS Server will also query
ns1.41414141.club for its response, as it is the NameServer for this domain.