nicholasC03/DNS-Poisoning-Triage-Lab

GitHubRepository PoCWriteup

PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository is an educational lab writeup for DNS and ARP traffic triage. It provides instructions for inspecting a packet capture, configuring Unbound with DNS-over-TLS, and comparing resolver outputs. It explicitly states that the evidence does not prove a live attack or attribute the traffic to CVE-2025-40778, and it contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and CVE_RESEARCH.md) are educational documentation for a DNS/ARP triage lab. They describe packet analysis, resolver hardening, and limitations of the evidence. No backdoor, deceptive payload, or concealed executable behavior is present in the supplied text. A binary pcap file is flagged as uninspected, but the text itself contains no instructions to execute it or any other harmful action.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownShell
Target softwareBIND 9Unbound
Attack typesDNS cache poisoningARP spoofing
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a writeup because it provides substantive technical analysis and educational instructions for traffic triage and resolver hardening. It contains no exploit or scanner code; the shell commands are for traffic inspection and configuration validation. The repository explicitly disclaims that it proves an attack or exploits a specific CVE.

README.md:1-5CVE_RESEARCH.md:1-32

Requirements

  • The writeup discusses DNS cache poisoning and ARP spoofing as educational topics, but does not provide code to exploit them. It notes that proving an attack would require additional evidence such as device inventories and resolver version information.README.md:5README.md:120

Observed behavior

  • The README provides instructions for inspecting a packet capture using tshark and Wireshark, comparing resolver outputs with a script, and configuring Unbound to forward DNS queries over TLS.README.md:22-25README.md:50-112
  • The CVE_RESEARCH.md file explains why the available evidence is insufficient to attribute the traffic to CVE-2025-40778, noting that the repository does not identify an affected BIND 9 resolver or its version.CVE_RESEARCH.md:17
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Binary File Uninspected
evidence/incident_triage_snippet.pcapA packet capture file is present but was not analyzed; its contents are unknown. The text documentation treats it as a benign educational sample.README.md:42
Review boundaries

What the analysis did not establish

  • The evidence packet includes a binary pcap file that was not analyzed; its content is only described by the repository's own documentation. The analysis is based solely on the provided text files.
  • One binary file (evidence/incident_triage_snippet.pcap) was flagged as uninspected; its contents were not analyzed and could theoretically contain malicious payloads, though the accompanying text does not instruct execution.
  • Only two of fourteen repository files were provided as text; the remaining twelve files (including scripts, configs, and logs) were omitted and not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1