Incognito has been the go-to choice when it comes to browsing without producing any history or traces of the searches/website visits. Every major browser nowadays is equipped with an Incognito Tab or something equivalent to it. It also prevents web browsers from sending user-related data elsewhere, which in turn allows for targeted ads or recommendations. Therefore, it is quite common to use incognito for searching stuff one wouldn’t want getting logged. But even though most would have thought incognito is the foolproof way of browsing without leaving any traces, it does have its own fair share of shortcomings. i.e., It won’t secure one’s searches if a keylogger has been installed onto the device, the incognito itself is malign. But even those could be mitigated by keeping one’s device secured and using reputed browsers. But one thing that all incognito options fall flat too is DNS traces.
In this article, we would learn how to use a DNS Resolver cache on Windows to obtain data regarding searches made on the Incognito tab.
For demonstration purposes, A clean installation of Chrome would be used and the DNS cache would be emptied. This allows us to see the effect of our searches on the cache. In practice, the cache would generally be littered with past records. The command that is used to see the DNS Resolver cache is.
ipconfig /displaydns
The following is the DNS Cache before the upcoming process.
As we can see the DNS Resolver Cache is empty.
1. Now we would be making a Google Search in Incognito tab to facebook.com
2. Now we have successfully made a search on the Incognito tab of our Chrome. Now to see the history of the Incognito tab we will run the displaydns command again.
3. This time we ended up with some output for the command. We can see DNS lookups happening over different domains. If we go down the list we will find the following output.
4. We can clearly see facebook.com in the list, which is the site we made our request. In the same fashion, any search (DNS Resolution/Lookups) made over the Incognito tab gets logged by the DNS Resolver cache. Which could be used to get an idea about the websites visited when using the incognito tab. This resolver cache is of utmost importance to the searches of a browser and if altered/modified could lead to DNS Poisoning attacks.