Bettercap/Failed DNS Spoofing Attack - Revision history

Admin: /* Notes */

2017-09-06T02:37:00Z

Notes

← Older revision		Revision as of 02:37, 6 September 2017
Line 48:		Line 48:
	We apparently have success?		We apparently have success?

	[[Image:Nope.jpg\|~~400px~~]]		[[Image:Nope.jpg\|200px]]

	Except, not really, because it blocks way more sites than it is supposed to.		Except, not really, because it blocks way more sites than it is supposed to.

Admin at 02:36, 6 September 2017

2017-09-06T02:36:14Z

← Older revision		Revision as of 02:36, 6 September 2017
Line 19:		Line 19:
	</pre>		</pre>

	This didn't work. Alternatives that I tried:		This didn't work. (NOTE: should have added <code>--httpd-port 80</code>)

			Alternatives that I tried:

	<pre>		<pre>

Admin at 02:20, 6 September 2017

2017-09-06T02:20:13Z

← Older revision		Revision as of 02:20, 6 September 2017
Line 1:		Line 1:
			Continuing notes from [[Bettercap#DNS_Spoofing]].

			=Notes=

	Now it's time to run our DNS spoofing attack with our malicious entries file.		Now it's time to run our DNS spoofing attack with our malicious entries file.

Line 6:		Line 10:
	* Running DNS spoofing attack against the sheep		* Running DNS spoofing attack against the sheep
	* Running DNS traffic through Bettercap DNS server		* Running DNS traffic through Bettercap DNS server
	* If facebook request found, forward them to NOPE		* If facebook request found, forward them to NOPE (http://charlesreid1.com/wiki/File:Nope.jpg)

	Each flag in the following bettercap command corresponds to one of the above tasks:		Each flag in the following bettercap command corresponds to one of the above tasks:
Line 38:		Line 42:
	</pre>		</pre>

	Now carry out the attack again. ~~And we~~ apparently have success:		Now carry out the attack again.

			We apparently have success?

	[[Image:~~NopeSucces~~.jpg\|400px]]		[[Image:Nope.jpg\|400px]]

	Except, not really, because it blocks way more sites than it is supposed to. ~~For example, MLB and NBA are also blocked, probably because they're associated:~~		Except, not really, because it blocks way more sites than it is supposed to.

	~~[[Image:NopeNBA~~.~~jpg\|400px]]~~		For example, MLB and NBA are also blocked, probably because they're associated.

	But then, the Kali Linux official site is also blocked.		But then, the Kali Linux official site is also blocked.

	~~[[Image:NopeKali.jpg\|400px]]~~

	Umm, wat?		Umm, wat?
Line 58:		Line 62:
	Disconnecting from network, resetting the mac address of the attacker machine, and reconnecting had no effect.		Disconnecting from network, resetting the mac address of the attacker machine, and reconnecting had no effect.

			=Conclusion=

			Need to be running an ARP spoof attack simultaneous with the DNS spoof attack - otherwise we'll be waiting for DNS traffic, but it will never come to us, because it only passes between the router and the client and not through the man in the middle.

			Picking this back up here: [[Bettercap/Failed DNS Spoofing Attack 2]]

	=Flags=		=Flags=

	{{MITMFlag}}		{{MITMFlag}}

Admin at 11:21, 5 September 2017

2017-09-05T11:21:30Z

← Older revision		Revision as of 11:21, 5 September 2017
Line 57:		Line 57:

	Disconnecting from network, resetting the mac address of the attacker machine, and reconnecting had no effect.		Disconnecting from network, resetting the mac address of the attacker machine, and reconnecting had no effect.


			=Flags=

			{{MITMFlag}}

Admin at 11:21, 5 September 2017

2017-09-05T11:21:07Z

← Older revision		Revision as of 11:21, 5 September 2017
Line 40:		Line 40:
	Now carry out the attack again. And we apparently have success:		Now carry out the attack again. And we apparently have success:

	[[Image:NopeSucces.~~png~~\|400px]]		[[Image:NopeSucces.jpg\|400px]]

	Except, not really, because it blocks way more sites than it is supposed to. For example, MLB and NBA are also blocked, probably because they're associated:		Except, not really, because it blocks way more sites than it is supposed to. For example, MLB and NBA are also blocked, probably because they're associated:

	[[Image:NopeNBA.~~png~~\|400px]]		[[Image:NopeNBA.jpg\|400px]]

	But then, the Kali Linux official site is also blocked.		But then, the Kali Linux official site is also blocked.

	[[Image:NopeKali.~~png~~\|400px]]		[[Image:NopeKali.jpg\|400px]]

	Umm, wat?		Umm, wat?

Admin: Created page with "Now it's time to run our DNS spoofing attack with our malicious entries file. Let's review all the things bettercap will be doing: * Using the wifi network interface * Sniff..."

2016-08-25T02:21:36Z

Created page with "Now it's time to run our DNS spoofing attack with our malicious entries file. Let's review all the things bettercap will be doing: * Using the wifi network interface * Sniff..."

New page

Now it's time to run our DNS spoofing attack with our malicious entries file.

Let's review all the things bettercap will be doing:
* Using the wifi network interface
* Sniffing and logging goodies to a file
* Running DNS spoofing attack against the sheep
* Running DNS traffic through Bettercap DNS server
* If facebook request found, forward them to NOPE

Each flag in the following bettercap command corresponds to one of the above tasks:

<pre>
$ bettercap -I wlan1 -O bettercap_extrabacon.log -X --gateway 192.168.0.1 --target 192.168.0.7 \
--dns extrabacon.conf --httpd --httpd-path ./pub
</pre>

This didn't work. Alternatives that I tried:

<pre>
# specify port 53 instead of 5300 (nope)
$ bettercap -I wlan1 -O bettercap_extrabacon.log -X --gateway 192.168.0.1 --target 192.168.0.7 --dns extrabacon.conf --dns-port 53 --httpd --httpd-path ./pub

# do not specify gateway (nope)
$ bettercap -I wlan1 -O bettercap_extrabacon.log -X --target 192.168.0.7 --dns extrabacon.conf --httpd --httpd-path ./pub

# run ARP poisoning attack too (nope)
$ bettercap -I wlan1 -O bettercap_extrabacon.log -S ARP -X --gateway 192.168.0.1 --target 192.168.0.7 --dns extrabacon.conf --httpd --httpd-path ./pub
</pre>

The problem is, the image/page is not loading. Possible underlying issues:
* The redirect is happening from port 443, not from port 80, so the firewall isn't redirecting the request to 8081
* The sheep's browser is detecting that an HTTPS request for facebook is being redirected to a non-HTTPS request for something else. It serves up an HTTPS Connection Not Secure warning.

Let's try against an insecure, non-HTTPS sportsball page, to see if it's the HTTPS that's causing problems. Put this in extrabacon.conf:

<pre>
local .*espn\.com
</pre>

Now carry out the attack again. And we apparently have success:

[[Image:NopeSucces.png|400px]]

Except, not really, because it blocks way more sites than it is supposed to. For example, MLB and NBA are also blocked, probably because they're associated:

[[Image:NopeNBA.png|400px]]

But then, the Kali Linux official site is also blocked.

[[Image:NopeKali.png|400px]]

Umm, wat?

I restarted the attack, watching the network interface from the beginning with Wireshark. The spoofing attack didn't seem to be working well as multiple DNS requests were being answered by the gateway. I could see requests being intercepted by attacker. But again, the requests were not being dealt with correctly - the DNS server was hijacking too many requests/domains.

I tried changing the port to port 53, but no effect. I also tried running an ARP spoofing attack to try and get all the traffic, not just the DNS traffic, from the sheep flowing through the attacker. That did not work and seemed to break something with the DNS attack. After I stopped trying a DNS and ARP attach together, I saw some very screwy behavior from the sheep: when I typed in a web address in the sheep's browser, I would not see any DNS packets at all showing up at the attacker. (Indication: maybe they're going somewhere else?)

Disconnecting from network, resetting the mac address of the attacker machine, and reconnecting had no effect.