In this lecture we'll be talking about DNS spoofing.
Now what is DNS in the first place DNS or domain name services is a service that runs sphere from name
to IP.
Anything on the network can only be communicated using an IP.
So for instance when you open a terminal like this one and you can go on now being w w w dot Yeah dot
com
my computer will not be able to communicate to Yahoo unless he got IP too.
I have a DNS server who will translate the Yahoo Web site to the IP.
This is a Yahoo.
IP and according to that he will be able to ping on Yahoo and get a reply back.
But if my DNS server was not as was not working for any reason if I typing yahoo dot com or even tried
to open pinged to the outcome I will not get any reply because he was not a will not able to resolve
from Name IP.
So it's very important to get an IP to be able to communicate for any Web site.
So here is a question what if the DNS I mean who's doing the DNS role right now in my network is my
router but in companies they usually have a computer who's doing that.
He got all the name and who also eyepiece whenever we do or send any request it would be sent to the
server first the server would resolve and get the IP or sends IP and then the communicator as a computer
would be able to communicate using the IP.
So what will happen if something went wrong with the server it shut down it crashed.
What will happen is it would try to bring on now to tell him so that I cannot pick on Yao there isn't
anything called Yao because he's not able to get people that he went to and search.
No one resolved the name for him.
So this is bad right.
But what will be worse is that what if I can manipulate the DNS server.
So instead of Yemen I'm gonna put the IP on the DNS server the the IP of Facebook so if someone type
or open yahoo dot com it it will open Facebook page because I change the IP.
It's like you are getting your cell phone and you are putting different number for a different name.
So you try to call your friend it call your father or something like that.
So how that can be that it can be bad if you use such technique for directing people to fake it with
websites so someone logging hit I Facebook dot com he will be automatically directed to a fake face
book page where once he writes his user name and password it will be capture.
He tried to go to Zemin it would be redirected to a fake human page.
So this will be really bad.
And you know it could be even worse since that that I can redirect them to a page not just for capturing
that user name and password but for installing a specific virus or warm or some malicious code on their
machines that would give me full access on that machine.
And we're going to see how to do that.
But my point is manipulating the DNS it's quite critical.
So let's see how to do that so we going to use a DNS spoofing by faking the DNS IP for some Web site.
And we can use ether cap for that.
Let's see how to do that.
So first as you can see if I ping on WW w dot google dot com I'm getting a reply from Google's Web site.
This is Google's Web site and this is Yahoo's Web site.
So I have another site so I would like to show it to you before doing the attack.
And this site is for testing and you can use it for testing.
It's called uh
certified hacker dot com.
So let me just open my browser and we're going to go see if this site is working or not.
So the site name is w w w dot.
So
do for it.
OK.
So I look
in game sites the name will get better.
Think is it's to
the font is too small so sometimes it's hard too.
So here you go let me show you the sights inside.
Look come OK now what would be the snap of you right now.
OK.
What I'm going to do.
I will assume that this is my target website.
So what I'm going to do that I'm going to mean you manipulate the audience using a circuit in the sense
that anyone who type etc. hacker dot com instead of going to is a hacker the com Web site he will be
redirected to yahoo dot com for instance.
So this would be our Google dot com.
I know that we be redirected to our and Hotmail.
It's not really considered an attack but we can associate that to another attack.
We can create a fake page and then it would be redirected to the fake page.
So in this stage I just want you to be familiar with how to manipulate DNS and makes people automatically
redirected to another webpage.
So very good certified I could become the first thing that are the first steps that you need to do it.
There is a specific file that we need to change
inside this file with me opens the terminal.
It's called ether the DNS so we open our terminal here if let's clear
and the file is located.
I mean if you don't or you'll forget the location you can just type the name into the DNS and he will
search for you or you can even social graphically.
I couldn't.
This is the location of the file inside ATC inside Ithaca.
So what I'm going to do I will type man
and I will take the file location copy
Beast and he's explaining you know how can you manipulate and give you some example and so on.
Let me go down and I can change one of those or I can write my own syntax in the same format.
So let's see let's see.
Okay.
Uh let's.
The
let's go here and do the following.
Let me go to the website which is it is it certified I could come
so I'll take this.
You are un certified.
I can come
or you can even change in one of the.
Could I can change from here.
Not a problem let me show you.
And I would paste it here.
But what I will do that I will move since it TGP What is it.
So I need to go here and I need to change the
TTP and instead of that with WWE I will add star sets mean whatever star to is any star.
But we certify that.
I mean if someone type Apache or RAM sorry portal good certified hacker older SharePoint or anything
so I'm going to put here star and eight star certified hacker dot com.
And besides this one I will add a letter saying we hear so much about space and then we're gonna put
any IP would like to
someone I mean went to this website you will be redirected to this IP so which IP would you like to
have.
Let's have me.
Okay let's do something nice.
You know this is IP for Microsoft.
You can take this one.
This is Microsoft IP.
Well you can ping on Google and get IP for Google or we can bring on.
So it's up to you.
So copy and paste.
So what I do is so far I'm telling him anyone that inside the network that need to go to certified hacker
dot com please take it to the specific IP which is Microsoft IP.
So point here that if this attack war instead of having Microsoft IP I'm going to put a fake Web site
IP I'm going to see that in social engineering then you can redirect them to a fake Web site where he
can use user name and password and will be captured or even we can have some malicious code inside this
fake Web site that will hacks the computer and give you access to it right away.
So let's see if this fine X Y and Z and let's see now how to establish that the.