Now in this lecture we're going to learn what DNA spoofing is and how to perform it.
DNS is a server that convert domain names such as Google dot com to the IP of the server that is hosting
this Web site.
So when you type Google dot com in your web browser the request goes to a DNS server the server responds
with the IP where Google dot com files are stored and the browser will load the web site from this IP.
Now when we are the man in the middle the request for Google dot com will pass to us first before it
goes to the DNS server.
Therefore instead of giving the IP of the server that is hosting Google dot com we can actually give
any IP we want so we can redirect them to a fake Web site with a backdoor or with evil code hijack software
updates and so much more will actually have examples on this in future lectures.
But for now let's see how we can run a basic DNS spoofing attack in which we redirect requests from
a specific Web site to our own Web site or our own Web server.
Now before we run Buttercup let us decide on where to redirect our target to so we can redirect them
to any Web site we want.
For example when someone requests Google dot com we can redirect them to Yahoo.
But what I want to do is I want to redirect them to my own Web site to a local Web site.
Then I'm going to start on Cali so Cali comes with its own Web server so we can actually use it as a
Web site and to do this all we have to do is just start the web server.
So we're going to do a service Apache to start so Apache 2 is the name of the web server and we're saying
that we want to start the service.
If I hit enter we see no errors which means that the server is working now and to access this Web site
to access the server.
We have to go to Carlie's IP so as you know to get our IP we can do if config and we can see our IP
is 10 0 to 15.
So if I just go to a web browser and go to 10 0 to 15 you'll see I'll get the default page of this Web
site.
Now the pages for this default Web site is stored in var w WW hasty e-mail.
So I'm going to open my file manager and I'm going to click here on the title bar press forward slash
to open it.
And we're going to go to var w w w hasty AML and as you can see these are the files for this Web site.
So if you want to install a fake Web site or any type of Web site all you have to do is just put its
files in here.
Now index notation here Mel is the file that gets loaded here by default.
So this is what you see in here.
So I'm actually going to right click it.
I'm going to open it with another application.
I'm going to select my text editor and this will open the hasty e-mail code for me.
And I'm actually just going to remove this and I'll just put a smiley face.
Like I said we're just doing this for testing.
So just showing you which files get loaded by default and where you can actually put a Web site if you
wanted to host a proper web site here.
So I'm gonna go back here and if I refresh the page you can see we get the smiley face in here.
That's perfect.
Right now we still haven't executed our DNS spoofing attack.
But what I want to do is when my target tries to go to a specific Web site I'm going to redirect them
to this page that shows this smiley face.
So let's go to the target machine first.
Let's go to our Target's Web site.
I'm gonna do this against my own Web site.
That security dot org so if you load this Web site you'll see you will get an actual security web site
with a number of topics and all that kind of stuff.
Basically the Web site is working as expected.
Now let's go ahead and run this attack.
So I'm going to go to Buttercup.
I'm going to run it using the exact same command that we've been using so far.
So we're just doing better come up with the interface with this proof couplets so we can intercept data
and modify it as it's flowing through our computer.
And as you can see it's running with no errors.
So that's all good.
Now the module that we want to use is called DNS poof.
So if I do help right now you can see it right here.
It's called DNS proof and it's not running.
And as usual if we don't know how to use a module all we have to do is do help followed by the module
name.
And in this case it's DNS spoof.
And as you can see we get all the options that we can set for this module.
First option being the DNS spoof address.
This is the address that the user will be redirected to.
So if you want to redirect them to another Web site you have to put the IP of this other Web site here.
In my case I want to redirect them to my local Web site to the Web site that we have here which is running
at 10 0 to 15.
Therefore I'm not going to have to modify this because by default this is set to the IP of my interface
the next thing that we want to modify is the DNS dot poof Dot.
All we want to set this to true.
So that better cop response to any DNS requests.
So just like any other option within Buttercup to change its value we have to do set followed by the
option name that we want to modify.
And in this case it's DNS dot spoof dot all and we want to set this to true.
Sorry.
This has all been produced by the sniffer.
The next option that we want to set is the DNS dot spoof dot domains.
This will specify the domains that we want to target that we want to spoof.
And as mentioned we can use a comma to separate more than one domain.
And as you know we want to target that security dot org and we want to redirect that to our own Web
site running on Carly so we need to change this option right here.
And as Dodd spoofed domains and again we're going to do this by doing said the option name which is
defined as Dodd spoof the domains and we're going to set this to Z Security dot org.
As mentioned in the option we can use the comma to specify more than one domain and the other domain
that I want to specify is star dot Z Security dot org.
So the star right here is a wild card and it basically means that I want to target any subdomain dot
Z Security dot org.
So I'm going to hit enter and we don't see any errors.
So everything is set as expected and all we need to do now is start the DNS spoof and to do this we
just need to run DNS dot spoof on exactly the same way that we start any other module I'm going to hit
enter.
And this should be running right now.
And as you can see it's telling us that it's going to spoof that security dot org to this IP which is
again this is our IP we verified this using the conflict command.
And keep in mind we actually did not have to give whether cup this IP it got it automatically.
It's also telling us that the other target is startled that security dot org and it'll be spoofed to
this now let's go to the target machine and test this.
And before you test this please keep in mind you might need to eat for a minute or two for the changes
to propagate.
Also if you just loaded this Web site just like I did right now it's a good idea to remove all your
browsing data.
You won't have to do this in real life scenarios unless the target person is constantly loading the
same page which doesn't happen a lot.
What if the target person goes ahead and browsers a few web sites comes back to Z Security dot org and
perfect as you can see we get redirected to the smiley face and instead of loading that security dot
org.
Now this will work against all Web sites even if they use hasty G.P.S. as you saw earlier Z security
users hash TTP Yes and it loaded over a hash TTP as by default the only Web sites that this will not
work against are Web sites that use h s t s because again as I mentioned before the browser has a list
of these Web sites.
The list is stored locally on the target computer so it doesn't send your requests and it will only
load these Web sites over hash TTP s.
So even though the attack will work the browser will refuse to load the web site that we are spoofing
them to.
Now as you can see what we did so far is not very useful all we did is just we showed a smiley face
but DNS spoofing is very very useful in so many scenarios you can use it for example when someone is
trying to go to a log in page and show them a fake page or if they're trying to go to Z security for
example and then just show them another Z Security Web site with some malware embedded into it.
You can also use it to serve fake updates so whenever they have a software that's going to check for
updates we can DNS proof that request and send them a fake update with a backdoor and we'll see that
later on in the course.
So it's a really really handy skill that can be used in so many scenarios.