Attack tree (DNS)¶

1. Exploit Protocol Weaknesses [OR]

    1.1 Cache Poisoning [OR]
    
        1.1.1 Exploit weak TXID entropy in DoH/DoT/DoQ resolvers [OR]
            1.1.1.1 Birthday attack on 16-bit TXID space
            1.1.1.2 Timing attacks on resolver response handling
            1.1.1.3 Fragment-based poisoning attacks
            
        1.1.2 Side-channel attacks on encrypted DNS [OR]
            1.1.2.1 TLS padding oracle attacks on DoT
            1.1.2.2 QUIC protocol timing analysis on DoQ
            1.1.2.3 HTTP/2 stream correlation attacks on DoH
            
        1.1.3 DNSSEC Exploitation [OR]
            1.1.3.1 NSEC/NSEC3 walking for zone enumeration
            1.1.3.2 RRSIG timing attacks for key recovery
            1.1.3.3 Algorithm downgrade attacks (to SHA-1 or an unsupported algorithm)
            
        Prerequisite: AND (Attacker can intercept traffic AND resolver lacks full DNSSEC validation)

    1.2 DDoS Amplification [OR]
    
        1.2.1 Abuse misconfigured encrypted DNS resolvers [OR]
            1.2.1.1 DoQ reflection with large TXT records
            1.2.1.2 DoH POST request amplification
            1.2.1.3 DoT session resumption attacks
            
        1.2.2 DNSSEC-based amplification [OR]
            1.2.2.1 NSEC3 response amplification
            1.2.2.2 Large RRSIG reflection attacks
            1.2.2.3 DNAME chain exploitation
            
        Prerequisite: AND (Open resolver available AND vulnerable payload size > 1000 bytes)

    1.3 Protocol-Specific Vulnerabilities [OR]
    
        1.3.1 QUIC Protocol Exploitation (DoQ) [OR]
            1.3.1.1 Connection migration hijacking
            1.3.1.2 Stream priority manipulation
            1.3.1.3 QUIC spin bit side-channel
            
        1.3.2 HTTP/2 Exploitation (DoH) [OR]
            1.3.2.1 HPACK header compression attacks
            1.3.2.2 Server push cache poisoning
            1.3.2.3 Stream dependency manipulation
            
        1.3.3 TLS Session Attacks (DoT) [OR]
            1.3.3.1 Session ticket stealing
            1.3.3.2 Pre-shared key exhaustion
            1.3.3.3 Certificate transparency log poisoning

2. Attack Encrypted DNS [OR]

    2.1 Privacy Leaks [OR]
    
        2.1.1 Metadata Correlation [AND]
            2.1.1.1 IP + timestamp correlation across multiple resolvers
            2.1.1.2 Query size and timing analysis
            2.1.1.3 Server name indication (SNI) monitoring
            
        2.1.2 ML-based fingerprinting [OR]
            2.1.2.1 Neural network traffic analysis
            2.1.2.2 Query pattern recognition
            2.1.2.3 Encrypted traffic classification
            
        2.1.3 Protocol Identification [OR]
            2.1.3.1 DoH/DoT/DoQ protocol fingerprinting
            2.1.3.2 Application-level protocol detection
            2.1.3.3 Middlebox cooperation for traffic analysis

    2.2 Downgrade Attacks [OR]
    
        2.2.1 Force fallback to plaintext DNS [OR]
            2.2.1.1 TCP RST injection on port 853 (DoT)
            2.2.1.2 HTTP/2 GOAWAY frame injection (DoH)
            2.2.1.3 QUIC connection close spoofing (DoQ)
            
        2.2.2 Encryption Bypass [OR]
            2.2.2.1 Disable ECH (Encrypted Client Hello) in DoH
            2.2.2.2 TLS version downgrade attacks
            2.2.2.3 QUIC version negotiation manipulation
            
        2.2.3 Middlebox Interference [OR]
            2.2.3.1 ISP-level protocol blocking
            2.2.3.2 Enterprise firewall policy enforcement
            2.2.3.3 Government-mandated protocol filtering

    2.3 Certificate Attacks [OR]
    
        2.3.1 CA Compromise [OR]
            2.3.1.1 Rogue certificate issuance
            2.3.1.2 Intermediate CA exploitation
            2.3.1.3 Certificate transparency log poisoning
            
        2.3.2 Client Validation Bypass [OR]
            2.3.2.1 Self-signed certificate acceptance
            2.3.2.2 Certificate pinning bypass
            2.3.2.3 Trust store manipulation

3. Cloud/SaaS Exploits [OR]

    3.1 Kubernetes DNS Compromise [OR]
    
        3.1.1 CoreDNS / Etcd cache poisoning [OR]
            3.1.1.1 API server compromise
            3.1.1.2 ConfigMap manipulation
            3.1.1.3 Plugin vulnerability exploitation
            
        3.1.2 NetworkPolicy Bypass [OR]
            3.1.2.1 Privileged pod escape
            3.1.2.2 Node-level network access
            3.1.2.3 Cross-namespace traffic interception
            
        3.1.3 Service Mesh Exploitation [OR]
            3.1.3.1 Istio/Linkerd DNS redirection
            3.1.3.2 mTLS certificate theft
            3.1.3.3 Sidecar proxy manipulation

    3.2 Serverless Abuse [OR]
    
        3.2.1 DNS Tunnelling [OR]
            3.2.1.1 Lambda TXT record exfiltration
            3.2.1.2 Cloud Functions DNS over HTTPS
            3.2.1.3 Azure Functions private resolver abuse
            
        3.2.2 Resource Exhaustion [OR]
            3.2.2.1 DNS query burst attacks
            3.2.2.2 Recursion depth exploitation
            3.2.2.3 Cache saturation attacks
            
        3.2.3 Cloud Integration Attacks [OR]
            3.2.3.1 AWS Route 53 resolver hijacking
            3.2.3.2 Google Cloud DNS API abuse
            3.2.3.3 Azure Private DNS zone poisoning

    3.3 Container Registry Attacks [OR]
    
        3.3.1 Image Pull Manipulation [OR]
            3.3.1.1 DNS spoofing for registry redirection
            3.3.1.2 MITM attacks on image downloads
            3.3.1.3 Cache poisoning for malicious images
            
        3.3.2 Supply Chain Compromise [OR]
            3.3.2.1 Malicious library injection via DNS
            3.3.2.2 Dependency confusion attacks
            3.3.2.3 Package manager DNS hijacking

4. Supply Chain Attacks [OR]

    4.1 Registrar Hijacking [OR]
    
        4.1.1 API Key Compromise [OR]
            4.1.1.1 Cloudflare token theft
            4.1.1.2 AWS Route 53 key leakage
            4.1.1.3 Google Domains API abuse
            
        4.1.2 Social Engineering [OR]
            4.1.2.1 Registrar support impersonation
            4.1.2.2 Post-GDPR WHOIS information gaps
            4.1.2.3 Phone number porting attacks
            
        4.1.3 Registry System Attacks [OR]
            4.1.3.1 EPP protocol exploitation
            4.1.3.2 Registry lock bypass
            4.1.3.3 Transfer process manipulation

    4.2 Subdomain Takeover [AND]
    
        4.2.1 Dangling Resource Identification [OR]
            4.2.1.1 CNAME mapping to unused cloud resources
            4.2.1.2 NS record pointing to decommissioned servers
            4.2.1.3 MX record targeting disabled services
            
        4.2.2 Malicious Content Deployment [OR]
            4.2.2.1 GitHub Pages site cloning
            4.2.2.2 S3 bucket takeover
            4.2.2.3 Azure Blob Storage hijacking
            
        4.2.3 Persistence Mechanisms [OR]
            4.2.3.1 SSL certificate procurement
            4.2.3.2 DNS record obfuscation
            4.2.3.3 Monitoring evasion techniques

    4.3 CDN Compromise [OR]
    
        4.3.1 DNS-Based CDN Manipulation [OR]
            4.3.1.1 Edge server cache poisoning
            4.3.1.2 Origin DNS spoofing
            4.3.1.3 GeoDNS manipulation
            
        4.3.2 Certificate Manipulation [OR]
            4.3.2.1 SAN certificate abuse
            4.3.2.2 CDN SSL termination bypass
            4.3.2.3 Multi-CDN configuration conflicts

5. AI/ML-Augmented Attacks [OR]

    5.1 Evasion Techniques [OR]
    
        5.1.1 Reputation System Poisoning [OR]
            5.1.1.1 DNS query pattern manipulation
            5.1.1.2 Behavioural model contamination
            5.1.1.3 Feedback loop exploitation
            
        5.1.2 Query Obfuscation [OR]
            5.1.2.1 GAN-generated benign-looking queries
            5.1.2.2 CDN traffic mimicry
            5.1.2.3 Legitimate domain spoofing
            
        5.1.3 Adaptive Attacks [OR]
            5.1.3.1 Reinforcement learning for evasion
            5.1.3.2 Genetic algorithm optimisation
            5.1.3.3 Transfer learning across networks

    5.2 Phishing Automation [AND]
    
        5.2.1 Domain Generation [OR]
            5.2.1.1 LLM-generated homograph domains
            5.2.1.2 Context-aware typosquatting
            5.2.1.3 Cultural adaptation algorithms
            
        5.2.2 Infrastructure Management [OR]
            5.2.2.1 Dynamic DNS fast-flux networks
            5.2.2.2 Automated certificate procurement
            5.2.2.3 Multi-CDN abuse for resilience
            
        5.2.3 Target Identification [OR]
            5.2.3.1 NLP-based brand monitoring
            5.2.3.2 Social media sentiment analysis
            5.2.3.3 Employee behaviour prediction

6. Post-Quantum Threats [OR]

    6.1 Cryptographic Harvesting [AND]
    
        6.1.1 DNSSEC signature capture for later forgery [OR]
            6.1.1.1 Record ECDSA-P256 signatures to forge once P-256 breaks
            6.1.1.2 Record RSA-2048 DNSKEYs to forge once RSA breaks
            6.1.1.3 NSEC3 chain enumeration
            
        6.1.2 Quantum Decryption Preparation [OR]
            6.1.2.1 Long-term encrypted data storage
            6.1.2.2 Future decryption capability planning
            6.1.2.3 Harvest-then-decrypt campaigns
            
        6.1.3 Transition Period Exploitation [OR]
            6.1.3.1 Algorithm confusion attacks
            6.1.3.2 Hybrid scheme weaknesses
            6.1.3.3 Backward compatibility exploitation

7. Data Exfiltration Techniques [OR]

    7.1 DNS Tunnelling [AND]
    
        7.1.1 Protocol Selection [OR]
            7.1.1.1 Traditional DNS (TXT, NULL records)
            7.1.1.2 DoH/DoT/DoQ encrypted tunnelling
            7.1.1.3 ICMP-based DNS manipulation
            
        7.1.2 Evasion Methods [OR]
            7.1.2.1 Query rate limiting bypass
            7.1.2.2 Legitimate traffic blending
            7.1.2.3 Multiple resolver rotation
            
        7.1.3 Data Encoding [OR]
            7.1.3.1 Base32/64 encoding variations
            7.1.3.2 Compression with error correction
            7.1.3.3 Fragmentation and reassembly

    7.2 Covert Channels [OR]
    
        7.2.1 Timing-Based Exfiltration [OR]
            7.2.1.1 Query response timing modulation
            7.2.1.2 DNS refresh interval exploitation
            7.2.1.3 TTL value manipulation
            
        7.2.2 Storage Channels [OR]
            7.2.2.1 DNS cache poisoning with data
            7.2.2.2 NSEC3 gap exploitation
            7.2.2.3 DNSSEC signature embedding
            
        7.2.3 Behavioural Patterns [OR]
            7.2.3.1 Query sequence encoding
            7.2.3.2 Resolver selection patterns
            7.2.3.3 Domain name generation algorithms

    7.3 Exfiltration Infrastructure [OR]
    
        7.3.1 Command and Control [OR]
            7.3.1.1 Dynamic domain generation
            7.3.1.2 DNS-based payload delivery
            7.3.1.3 Dead drop resolvers
            
        7.3.2 Data Processing [OR]
            7.3.2.1 Distributed exfiltration aggregation
            7.3.2.2 On-the-fly decoding services
            7.3.2.3 Cloud function data processing
            
        7.3.3 Persistence Mechanisms [OR]
            7.3.3.1 Multiple exfiltration pathways
            7.3.3.2 Fallback communication channels
            7.3.3.3 Anti-forensic techniques