I guess this is not considered a true MITM attack since the attacker does not have to be between the server and client. My question is how it is possible to poison a DNS cache, and redirect traffic to your computer that is hosting a proxy that then forwards traffic to the actual web server? I wanted to simulate an such an attack by setting up BIND on my network but I'm not sure how to configure a proxy like paros to forward traffic to a specific web server. For example, I will run Apache on 192.168.1.2 which will host www.example.com on my LAN, BIND on 192.168.1.2, and Paros on 192.168.1.3. I will then use Kaminsky's improved birthday attack to poison the cache of the bind server which will redirect all queries of www.example.com (192.168.1.2) to 192.168.1.3 which runs Paros. I can do everything up to this point, but I don't know how to properly configure Paros to then forward traffic to the actual web server @ 192.168.1.2 whenever www.example.com is queried by another host on my network.
This is not exactly what you were asking for, and I'm not sure if it's close enough...
From the linked wikipedia article:
Specifically to what you were asking, if a DNS server or client is not configured correctly, they may accept DNS responses, even if they did not originally send that request. In that case, it would be possible to send an arbitrary DNS record, that will be cached and saved by the DNS server.