Blog Security Research Weaponizing DHCP DNS Spoofing — A Hands-On Guide Ori David is a Security Researcher at Akamai. His research is focused on offensive security, malware analysis, and threat hunting.  Introduction \n In the first part of this blog series we introduced a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers. These attacks enable threat actors to spoof DNS records in Active Directory Integrated DNS (ADIDNS) zones by abusing the DHCP DNS Dynamic Updates feature. We explored the feature’s operation and highlighted misconfigurations that could be abused by attackers to spoof sensitive DNS records.  \n In this second blog post, we aim to elaborate on some of the technical details that are required to exploit this attack surface.…