Summary
During security testing of amplenote.com, it was identified that DNS Security Extensions (DNSSEC) are not enabled for the domain.
DNSSEC is a security enhancement for the Domain Name System (DNS) that provides cryptographic validation of DNS responses. Without DNSSEC, attackers may attempt DNS cache poisoning or DNS spoofing attacks, potentially redirecting users to malicious servers without their knowledge. DNSSEC helps ensure that DNS responses are authentic and have not been modified during transit.
Although the website itself may use HTTPS, DNS resolution occurs before the TLS connection is established. If DNS is compromised, users can still be directed toward attacker-controlled infrastructure.
Vulnerability Details
Issue: DNSSEC Not Configured
The domain does not publish the required DNSSEC records (such as DS, DNSKEY, and RRSIG), indicating that DNS responses cannot be cryptographically verified.
Without DNSSEC protection:
DNS responses cannot be validated.
DNS cache poisoning becomes more feasible.
Users may be redirected to malicious infrastructure.
Email services relying on DNS integrity may also be affected.
Steps to Reproduce
Step 1
Open the DNSSEC testing tool:
POC
https:
Step 2
Enter:
amplenote.com
Step 3
Click Check DNSSEC.
Step 4
Observe the results.
The scanner reports that DNSSEC is not enabled, meaning the domain does not provide DNSSEC signatures required for DNS response validation.
Proof of Concept (PoC)
Target:
amplenote.com
Tool:
Geekflare DNSSEC Test
Result:
DNSSEC: Disabled
Required Records Missing:
- DS
- DNSKEY
- RRSIG
Conclusion:
DNS responses cannot be cryptographically validated.
Reference:
https:
Working PoC
An attacker positioned on a vulnerable network (public Wi-Fi, compromised ISP, malicious recursive resolver, or poisoned DNS cache) could attempt to forge DNS responses for amplenote.com.
Example attack flow:
Victim attempts to visit:
https:
The attacker injects a forged DNS response before the legitimate response.
Because DNSSEC validation is unavailable, the resolver cannot verify the authenticity of the response.
The victim may be directed to an attacker-controlled IP address.
The attacker hosts a phishing page closely resembling the legitimate Amplenote login.
Users may unknowingly submit credentials or sensitive information.
DNSSEC significantly reduces this class of attack by allowing validating resolvers to reject forged DNS data.
Demonstration
User
│
│ DNS Request
▼
Recursive Resolver
│
│ (No DNSSEC Validation)
▼
Attacker injects forged DNS response
│
▼
Victim connects to malicious server
│
▼
Credential theft
Malware delivery
Phishing
Traffic interception
Exploitation Scenario
An attacker could:
Poison recursive DNS caches.
Manipulate DNS responses.
Redirect users to phishing infrastructure.
Steal usernames and passwords.
Capture authentication tokens.
Deliver malware.
Intercept email-related DNS lookups.
Damage customer trust through convincing fake websites.
Successful exploitation depends on additional conditions (such as the ability to influence DNS resolution), but the absence of DNSSEC removes an important layer of protection.
Impact
Security Impact
Increased risk of DNS spoofing.
Increased risk of DNS cache poisoning.
Loss of DNS integrity.
Easier phishing campaigns.
Reduced protection against forged DNS responses.
Greater opportunity for man-in-the-middle attacks at the DNS layer.
User Impact
Users may experience:
Redirection to fake websites.
Credential theft.
Exposure of sensitive information.
Malware downloads.
Account compromise.
Loss of confidence in the service.
Business Trust and Reputation
Failure to implement DNSSEC can negatively affect the organization's security posture:
Reduced customer confidence.
Increased phishing risk using the brand.
Potential financial losses due to account compromise.
Increased support costs after phishing incidents.
Damage to brand reputation.
Compliance and security audit findings.
Lower confidence from enterprise customers and security-conscious partners.
Recommendations / Fix
Enable DNSSEC for the domain by:
Enable DNSSEC at the authoritative DNS provider.
Generate DNSSEC signing keys (KSK and ZSK).
Publish DNSKEY records.
Publish the corresponding DS record at the domain registrar.
Verify the complete chain of trust.
Test the configuration using multiple DNSSEC validation tools.
Monitor DNSSEC key rotation and signature validity.
Regularly audit DNSSEC configuration after DNS or registrar changes.
After deployment, validate that DNSKEY, DS, and RRSIG records are correctly published and that DNSSEC validation succeeds.