MITM/DNS - Revision history

Unknown user: /* Bettercap */

2022-03-25T04:49:24Z

Bettercap

← Older revision		Revision as of 04:49, 25 March 2022
Line 29:		Line 29:
	This will perform DNS spoofing, meaning Bettercap will trick the sheep into sending all of its DNS requests to the attacker instead of to the gateway. This allows the attacker to hijack traffic to certain sites.		This will perform DNS spoofing, meaning Bettercap will trick the sheep into sending all of its DNS requests to the attacker instead of to the gateway. This allows the attacker to hijack traffic to certain sites.

	When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to ~~man~~-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.		When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to monkey-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.

	See the [[Bettercap#DNS Spoofing]] page for more detailed notes.		See the [[Bettercap#DNS Spoofing]] page for more detailed notes.

Unknown user: /* DNS Attacks */

2022-03-25T04:49:08Z

DNS Attacks

← Older revision		Revision as of 04:49, 25 March 2022
Line 5:		Line 5:
	DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works, and it makes navigating the web possible - nay, even easy! - for non-machine meatbags.		DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works, and it makes navigating the web possible - nay, even easy! - for non-machine meatbags.

	To perform attacks on DNS traffic, we will, of course, need access to the sheep's traffic. We cannot selectively intercept the sheep's DNS traffic without, well, actually intercepting the sheep's traffic. Therefore, we will need to use a technique to [[~~Man in the~~ Middle]] the sheep before we can proceed to hijack DNS requests.		To perform attacks on DNS traffic, we will, of course, need access to the sheep's traffic. We cannot selectively intercept the sheep's DNS traffic without, well, actually intercepting the sheep's traffic. Therefore, we will need to use a technique to [[MITM\|Monkey In The Middle]] the sheep before we can proceed to hijack DNS requests.

	One such method is [[ARP Poisoning]] with [[Bettercap]], which conveniently performs DNS attacks as well.		One such method is [[ARP Poisoning]] with [[Bettercap]], which conveniently performs DNS attacks as well.

Unknown user: Admin moved page Man in the Middle/DNS to MITM/DNS

2022-03-05T20:39:13Z

Admin moved page Man in the Middle/DNS to MITM/DNS

← Older revision	Revision as of 20:39, 5 March 2022
(No difference)

Admin: /* Bettercap */

2016-08-26T05:13:33Z

Bettercap

← Older revision		Revision as of 05:13, 26 August 2016
Line 31:		Line 31:
	When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to man-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.		When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to man-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.

	See the [[Bettercap]] page for more detailed notes.		See the [[Bettercap#DNS Spoofing]] page for more detailed notes.

	==dnsspoof==		==dnsspoof==

Admin: /* EvilFOCA */

2016-08-26T05:13:02Z

EvilFOCA

← Older revision		Revision as of 05:13, 26 August 2016
Line 32:		Line 32:

	See the [[Bettercap]] page for more detailed notes.		See the [[Bettercap]] page for more detailed notes.

			==dnsspoof==

			You can also MITM attack a sheep's DNS using [[Dnsspoof]], which is part of the [[Dsniff]] suite. It is a specialized tool intended solely for DNS spoofing. If you use dnsspoof, you should combine it with another tool like arpspoof or Bettercap to perform an ARP poisoning attack, or use some other technique for gaining control of the sheep's traffic.

	==EvilFOCA==		==EvilFOCA==

Admin: /* DNS Hijacking */

2016-08-25T07:33:34Z

DNS Hijacking

← Older revision		Revision as of 07:33, 25 August 2016
Line 16:		Line 16:

	This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].		This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].

			Current status: failing

	=Tools=		=Tools=

Admin: /* DNS Attacks */

2016-08-24T23:42:12Z

DNS Attacks

← Older revision		Revision as of 23:42, 24 August 2016
Line 1:		Line 1:
	=DNS Attacks=		=DNS Attacks=

	So what is DNS anyway? DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works.		So what is DNS anyway?

			DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works, and it makes navigating the web possible - nay, even easy! - for non-machine meatbags.

			To perform attacks on DNS traffic, we will, of course, need access to the sheep's traffic. We cannot selectively intercept the sheep's DNS traffic without, well, actually intercepting the sheep's traffic. Therefore, we will need to use a technique to [[Man in the Middle]] the sheep before we can proceed to hijack DNS requests.

			One such method is [[ARP Poisoning]] with [[Bettercap]], which conveniently performs DNS attacks as well.

	==DNS Hijacking==		==DNS Hijacking==

Admin: /* Flags */

2016-08-24T23:35:17Z

Flags

← Older revision		Revision as of 23:35, 24 August 2016
Line 36:		Line 36:
	* Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server		* Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server
	* DNS Hijacking - hijacking the sheep's DNS channel to control where the sheep's requests point them		* DNS Hijacking - hijacking the sheep's DNS channel to control where the sheep's requests point them

			=Links=

			==Related Pages==

			* [[Linux/DNS]]

			* [[DoS/DNS]]

	=Flags=		=Flags=

	{{MITMFlag}}		{{MITMFlag}}

Admin: /* DNSSmurf */

2016-08-24T23:20:00Z

DNSSmurf

← Older revision		Revision as of 23:20, 24 August 2016
Line 10:		Line 10:

	This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].		This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].

	~~==DNSSmurf==~~

	~~A DNS Smurf Attack works the same way as a [[Smurf Attack]], except instead of swamping a victim with ping packets, it swamps a victim with DNS query response packets.~~

	In this attack, an attacker wishes to create a denial of service for a sheep. The attacker will overwhelm the sheep's network card with traffic, so that it can't possibly continue to function normally. The attacker does so by spoofing a large number of DNS queries that look like they come from the sheep's machine, that ask "What is the IP address of google.com?" When this packet reaches a DNS server, it will respond with a packet that says "The IP address is A.B.C.D". By spoofing a large number of queries, and sending them to a large number of DNS servers, the attacker creates a network packet tsunami that drowns the sheep's network card.

	~~See [[DNSSmurf]] for details.~~

	=Tools=		=Tools=

Admin: /* DNS Hijacking */

2016-08-24T23:19:46Z

DNS Hijacking

← Older revision		Revision as of 23:19, 24 August 2016
Line 10:		Line 10:

	This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].		This type of attack can be carried out with the [[Bettercap]] tool. See below or [[Bettercap#DNS Spoofing]].

			==DNSSmurf==

			A DNS Smurf Attack works the same way as a [[Smurf Attack]], except instead of swamping a victim with ping packets, it swamps a victim with DNS query response packets.

			In this attack, an attacker wishes to create a denial of service for a sheep. The attacker will overwhelm the sheep's network card with traffic, so that it can't possibly continue to function normally. The attacker does so by spoofing a large number of DNS queries that look like they come from the sheep's machine, that ask "What is the IP address of google.com?" When this packet reaches a DNS server, it will respond with a packet that says "The IP address is A.B.C.D". By spoofing a large number of queries, and sending them to a large number of DNS servers, the attacker creates a network packet tsunami that drowns the sheep's network card.

			See [[DNSSmurf]] for details.

	=Tools=		=Tools=