MITM/DNS

DNS Attacks

So what is DNS anyway? DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works.

DNS Hijacking

DNS hijacking consists in an attacker hijacking DNS traffic from the sheep in order to maliciously redirect the sheep to servers of our own choosing.

This is typically achieved at Level 3 and 4 on a network: ARP spoofing to redirect a sheep's traffic through the attacker, and a DNS server to handle requests (to send the sheep to our malicious server) or forward requests on to other DNS servers to take care of. However, it can also be achieved at the physical layer, by modifying the filesystem of a sheep's computer to permanently point to a pirate DNS server.

This type of attack can be carried out with the Bettercap tool. See below or Bettercap#DNS Spoofing.

DNSSmurf

A DNS Smurf Attack works the same way as a Smurf Attack, except instead of swamping a victim with ping packets, it swamps a victim with DNS query response packets.

In this attack, an attacker wishes to create a denial of service for a sheep. The attacker will overwhelm the sheep's network card with traffic, so that it can't possibly continue to function normally. The attacker does so by spoofing a large number of DNS queries that look like they come from the sheep's machine, that ask "What is the IP address of google.com?" When this packet reaches a DNS server, it will respond with a packet that says "The IP address is A.B.C.D". By spoofing a large number of queries, and sending them to a large number of DNS servers, the attacker creates a network packet tsunami that drowns the sheep's network card.

See DNSSmurf for details.

Tools

Bettercap

Yep, Bettercap can execute MITM DNS attacks. This consists of two steps:

• Define your malicious DNS entries
• Execute your bettercap DNS attack

This will perform DNS spoofing, meaning Bettercap will trick the sheep into sending all of its DNS requests to the attacker instead of to the gateway. This allows the attacker to hijack traffic to certain sites.

When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to man-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.

See the Bettercap page for more detailed notes.

EvilFOCA

Main article: EvilFOCA

Windows tool

Link: https://github.com/ElevenPaths/EvilFOCA

Tool for conducting various DNS attacks (and other types of attacks)

• Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server
• DNS Hijacking - hijacking the sheep's DNS channel to control where the sheep's requests point them