Instructor: Now in this lecture,
we're going to learn what DNS spoofing is
and how to perform it.
DNS is a server that converts domain names,
such as google.com, to the IP of the server
that is hosting this website.
So, when you type google.com in your web browser,
the request goes to a DNS server,
the server responds with the IP
where google.com files are stored,
and the browser will load the website
from this IP.
Now, when we are the man in the middle,
the request for google.com
will pass through us first
before it goes to the DNS server.
Therefore, instead of giving the IP
of the server that is hosting google.com,
we can actually give any IP we want.
So we can redirect them to a fake website
with a backdoor or with evil code,
hijack software updates and so much more.
We'll actually have examples on this
in future lectures but for now
let's see how we can run
a basic DNS spoofing attack,
in which we redirect requests
from a specific website to our own website
or our own web server.
Now before we run bettercap,
let's decide on where to redirect our target to.
So, we can redirect them to any website we want,
for example when someone requests google.com,
we can redirect them to Yahoo.
But what I want to do is
I want to redirect them to my own website,
to a local website that I'm gonna start on Kali.
Kali comes with its own web server
so we can actually use it as a website
and to do this, all we have to do
is just start the web server
so we're gonna do service apache2 start.
So apache2 is the name of the web server
and we're saying that we want to start this service.
If I hit Enter, we see no errors,
which means that the server is working now.
And to access this website,
to access this server,
we have to go to Kali's IP.
So as you know, to get our IP we can do ifconfig,
and we can see our IP is 10.0.2.15.
So if I just go to a web browser
and go to 10.0.2.15,
you'll see I'll get the default page of this website.
Now, the pages for this default web site
is stored in var/www/html.
So I'm gonna open my file manager
and I'm gonna click here on the title bar,
press forward slash to open it,
and we're gonna go to var/www/html,
and as you can see, these are the files
for this website.
So if you want to install a fake website
or any type of website, all you have to do
is just put its files in here.
Now, index.html is the file
that gets loaded here by default.
So this is what you see in here.
So I'm actually gonna right-click it.
I'm gonna open it with another application.
I'm gonna select my Text Editor.
This will open the html code for me,
and I'm actually just gonna remove this,
and I'll just put a smiley face.
Like I said, we're just doing this for testing,
so just showing you which files get loaded by default
and where you can actually put a website
if you wanted to host a proper website here.
So, I'm gonna go back here and if I refresh the page,
you can see we get the smiley face in here.
Now that's perfect.
Right now we still haven't executed
our DNS spoofing attack
but what I want to do is,
when my target tries to go to a specific website
I'm gonna redirect them to this page
that shows the smiley face.
So let's go to the target machine first
and let's go to our target website.
I'm gonna do this against my own website,
zsecurity.org.
So if you load this website,
you'll see we'll get an actual security website
with a number of topics and all that kind of stuff.
Basically the website is working as expected.
Now let's go ahead and run this attack.
So I'm gonna go to bettercap.
I'm gonna run it using the exact same command
that we've been using so far.
So we're just doing bettercap
with the interface with the spoof caplet
so we can intercept data and modify it
as it's flowing through our computer.
And as you can see, it's running with no errors
so that's all good.
Now, the module that we want to use
is called dns spoof.
So if I do help right now,
you can see it right here,
it's called dns spoof and it's not running.
And as usual, if we don't know how to use a module,
all we have to do is do help
followed by the module name
and in this case it's dns spoof.
And as you can see we get all the options
that we can set for this module.
First option being the dns spoof address.
This is the address that the user
will be redirected to.
So if you want to redirect them
to another website, you have to put
the IP of this other website here.
In my case I want to redirect them
to my local website,
to the website that we have here,
which is running at 10.0.2.15.
Therefore, I'm not gonna have to modify this
because by default this is set
to the IP of my interface.
The next thing that we want to modify
is the dns.spoof.all.
We want to set this to true
so that bettercap responds
to any DNS request.
So just like any other option within bettercap
to change its value, we have to do set,
followed by the option name
that we want to modify,
and in this case it's dns.spoof.all,
and we want to set this to true.
Sorry, this is all being produced by the sniffer.
The next option that we want to set
is the dns.spoof.domains.
This will specify the domains
that we want to target,
that we want to spoof.
And as mentioned, we can use a comma
to separate more than one domain.
And as you know, we want to target zsecurity.org
and we want to redirect that
to our own website running on Kali.
So, we need to change this option right here,
dns.spoof.domains, and again,
we're gonna do this by doing set,
the option name, which is dns.spoof.domains,
and we're gonna set this to zsecurity.org.
As mentioned in the option
we can use the comma
to specify more than one domain
and the other domain that I want to specify
is star .zsecurity.org.
So the star right here is a wildcard
and it basically means that I want to target
any subdomain .zsecurity.org.
So I'm gonna hit Enter
and we don't see any errors
so everything is set as expected.
And all we need to do now
is start the dns spoof and to do this,
we just need to run dns.spoof
on exactly the same way that we start
any other module.
I'm gonna hit Enter and this should be running right now
and as you can see, it's telling us
that it's going to spoof zsecurity.org
to this IP, which is again, this is our IP,
we verified this using the ifconfig command.
And keep in mind, we actually did not have
to give bettercap this IP.
It got it automatically.
It's also telling us that the other target
is star .zsecurity.org
and it'll be spoofed to this.
Now, let's go to the target machine
and test this and before you test this,
please keep in mind you might need to wait
for a minute or two for the changes to propagate.
Also, if you just loaded this website,
just like I did right now,
it's a good idea to remove all your browsing data.
You won't have to do this in real-life scenarios
unless the target person is constantly loading
the same page, which doesn't happen a lot.
But if the target person goes ahead
and browses a few websites,
comes back to zsecurity.org,
and perfect.
As you can see, we get redirected
to the smiley face instead of loading zsecurity.org.
Now, this will work against all websites
even if they use HTTPS.
As you saw earlier, zSecurity uses HTTPS
and it loaded over https by default.
The only websites that this will not work against
are websites that use HSTS
because again, as I mentioned before,
the browser has a list of these websites,
the list is stored locally on the target computer
so it doesn't send any requests
and it'll only load these websites over HTTPS.
So even though the attack will work,
the browser will refuse to load the website
that we are spoofing them to.
Now, as you can see, what we did so far
is not very useful.
All we did is just we showed a smiley face.
But DNS spoofing is very very useful
in so many scenarios.
You can use it, for example,
when someone is trying to go to a login page
and show them a fake page,
or if they're trying to go
to zSecurity, for example,
and then just show them another zSecurity website
with some malware embedded into it.
You can also use it to serve fake updates.
So whenever they have a software
that's gonna check for updates,
we can DNS spoof that request
and send them a fake update with a backdoor,
and we'll see that later on in the course.
So it's a really really handy skill
that can be used in so many scenarios.