[equi_gonzales13]

Hello there,

So, I think that everyone is aware that even when someone is browsing through incognito mode, the records of the visited websites are kept and can be retrieved by using the "Display DNS" command on Windows ("ipconfig /displaydns")

The thing is that those records expire after a particular amount of time or when the system reboots.

The question is, how can we configure the DNS on a system on which we have physical access, in order to save all the records despite the time visited or any possible reboot?

[CyberStrike]

Looks like they can be retrieved already something dopey as

$dnsdisplay=dnsdisplay.txt
#timer
$timer = New-Object Timers.Timer
# works every 1 minute
$timer.Interval = 60000
# set to false if you dont want the event again after its been run
$timer.AutoReset = $true
$timer.Enabled = $true
Register-ObjectEvent -InputObject $timer -EventName Elapsed -SourceIdentifier ipconfig -Action {powershell.exe -windowstyle hidden ipconfig /displaydns >> $dnsdisplay}


I personally would just make a simple powershell script to fire ipconfig /displaydns and have it as a scheduled task. (Code might not be 100% not on a Windows box right now.)