After changing the configuration file and before implementing that attack let's first get to know what
is IP of this Web site.
So let me open another terminal and let me ping on this Web site.
And don't forget that this is the site that I change its IP.
So ever need or want to go to this Web site.
You will go to a different IP so let's see
Bobby
need to be just a website name
so
this IP is 6 9 4 9 sorry 6 9 8 9 3 1 1 93.
Okay sounds good.
While the Microsoft IP if you remember it was uh two hundred and something.
So I want you to make sure that you are distinguished between both of them.
So Microsoft tools 46 it 46.
Okay Microsoft 46 while this one is sixty nine.
So let's close this terminal and let's close this one as well.
And now let's implements attack.
How can we implement that.
We can do that in two different ways.
We can use user caps a graphical interface but since we use these are kept graphical interface before
us before I will use the command line command line is more powerful except the problems that as any
command line you need to memorize some switches.
So this is a common ether cap minus kept a..
That's mean graphical because text line because you remember graphical maintenance capital G minus Q
minus M and then are remote and then minus capital P which is a plug that we will use it to use the
files that we change which is DNS spoofing and trivial slash.
So that means that he will implement this file to any traffic inside the network so anyone inside the
network not just a specific machine like the previous scenario but any computer on the network that
need to go to this certified hacker to come he will go to Microsoft Web site.
So let's reset and let's wait until Yeah it's activating.
So now let's see if it has been applied or not.
So what I'm going to do I will go to my uh victim machine.
Windows 7 or Windows 8 or any machine and before test things that we need to flush the IP information.
I mean sometimes you try to this attack but since there was some information inside the cache.
So because if you type uh
IP config
slash.
Uh display.
Since think it was displayed DNS.
The DNS showed DNS.
I don't recall what was the comment.
Uh a new release.
The Rosie comments are showing the cache DNS sync to show DNS.
Display DNS is just crazy.
So my point was that sometimes the DNS information is cached into the memory and according to that.
Yeah display DNS.
So let's do that IP config slash
might be context less.
This is a yes on some kind of client display.
Okay so what we'll do just to make sure that all the cache information has been removed.
I will type IP conflict slash release to release this IP and then IP content slash for you
to request the new IP and he got a new IP right now and what you gonna do it's Let's see.
We will try to ping this
thing on w w w dot so if you find
dot com.
Oh.
Think w w w dot Sue to buy
so let's see.
I dunno if he noticed or not but you see the reply is coming from this IP forty seven two to eight and
the remaining IP if you remember this is Microsoft IP.
So according to that when you try to pin on certified hacker you are getting to Microsoft webpage.
Microsoft reply so that means that we successfully changed DNS.
Now let's see if we browse certified I could become
Google certified hacker dot com and let's put that into the browser
based
and let's see
what is not showing any page.
But as you see inside the Ping said he.
The reply came back from Microsoft dot com.
Let's go get it.
I think there is a problem with this browser.
No gay I'm not sure but I believe there is a problem in the browser.
But as you can see that the DNS has been changed and a better
like to confirm that this is Microsoft's Web site.
Let's take it to an S lookup
and as lookup will translate the IP to a name or a name to IP so you can see which IP is it.
And as you can see it's Microsoft dot com.
So it has been changed.
I was able to manipulate the DNS and I can apply that to all the network devices.
Now keep that in mind.
And while we are taking the social engineering path we're going to create a fake Web site and we're
going to put some payload in sites that allow us to compromise the system.
And if you combine those two attack together you are giving.
You are taking the IP of this fake Web site and replace it wi with a right IP for Microsoft or Google
or Facebook.
So whoever go to the speech will be redirected to your page automatically and you'll be getting access
to the machine.
So that attack is not completed yet.
The attack will be completed once you take another path.
But meanwhile I want you to practice this DNS and I want to test on different operating system using
virtual machine to.
Do not use it in a production environment.
So let's have Windows XP and Windows 7 and Windows 8 on different virtual machine and see which one
would be manipulated or which one will not be the DNS will not be manipulated.
So this is a good exercise.
And believe me once you get that besides a part in the social engineering for creating fake world page
and putting some payload inside you'll be able to do some amazing attack.