PCAP 27

This challenge involves downloading and analyzing a PCAP file that contains multiple DNS packets. IoT devices often suffer from predictable transaction IDs, which are used to protect DNS queries from malicious responses. By using tools like Wireshark, you will identify a DNS query with a fixed transaction ID set to 0. This predictable ID allows attackers to easily send rogue DNS responses, as there are no mechanisms in place to prevent such attacks in these devices.

You'll learn to filter and inspect the PCAP file for DNS queries with the transaction ID set to 0. The goal is to find the DNS query with this specific ID and determine the hostname, which will serve as the key to solving the exercise. This lab emphasizes the importance of ensuring that IoT devices use unpredictable transaction IDs to prevent potential security vulnerabilities.