2

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did.

  1. Tampered ip_forward to 1 in /proc/sys/net/ipv4
  2. Started a credential Harvester and cloned site.
  3. Set the POST payback to my own IP address.

  4. In etter.dns, added the following.

    http://www.facebook.com
https://www.facebook.com
*facebook.com
www.facebook.com

  5. Ran the following command

    ettercap -T -q -i eth0 -d dns_spoof -M arp ///`<br><br>

Problem

When I type the IP of kali machine, I am able to get the cloned facebook.com page. But When I type, facebook.com on browser, I get ERR_CONNECTION_REFUSED. How can I let it access the fake page, I have created.

P.S Though, I am able to catch all the SNMP packets, my router has been sending to the victim. (So, I suppose, ARP spoofing is correctly done.)

Improve this question
6
  • 1
    Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see code.google.com/p/chromium/codesearch#chromium/src/net/http/… - the same list is used by Firefox) and won't load if the certificate signer doesn't match the expected one. Try spoofing a smaller site - might well work.
    – Matthew
    Commented Mar 11, 2016 at 16:32
  • What if, I want to tackle that as well ?
    – Panda
    Commented Mar 11, 2016 at 16:41
  • 1
    Get a certificate signed by one of the CAs referenced in that file under Facebook - "SymantecClass3EVG3", "DigiCertECCSecureServerCA", "DigiCertEVRoot", or "FacebookBackup". You'd need to get an EV certificate based on the names, in order to have the right CA chain, which you shouldn't be able to do, unless you are actually a registered company called Facebook. It's almost exactly what it's designed to protect against.
    – Matthew
    Commented Mar 11, 2016 at 16:46
  • Ok, I guess, that was valid point. Another thing. How do I get css of orignal web page in my page?
    – Panda
    Commented Mar 11, 2016 at 16:50
  • @M.S.P You could also just redirect the user to faebook.com or something like that.
    – Apache
    Commented Mar 11, 2016 at 23:52

1 Answer 1

Reset to default
4

Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome source - the same list is used by Firefox) and won't load if the certificate signer doesn't match the expected one.

In order to defeat that, you would need to get a certificate signed by one of the CAs referenced in that file under Facebook - "SymantecClass3EVG3", "DigiCertECCSecureServerCA", "DigiCertEVRoot", or "FacebookBackup". You'd need to get an EV certificate based on the names, in order to have the right CA chain, which you shouldn't be able to do, unless you are actually a registered company called Facebook. It's almost exactly what it's designed to protect against.

You would probably be able to spoof a site which isn't on the HSTS preload lists with the settings you have.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .