2

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did.

  1. Tampered ip_forward to 1 in /proc/sys/net/ipv4
  2. Started a credential Harvester and cloned site.
  3. Set the POST payback to my own IP address.
  4. In etter.dns, added the following.

    http://www.facebook.com
    https://www.facebook.com
    *facebook.com
    www.facebook.com
    
  5. Ran the following command

    ettercap -T -q -i eth0 -d dns_spoof -M arp ///`<br><br>
    

Problem

When I type the IP of kali machine, I am able to get the cloned facebook.com page. But When I type, facebook.com on browser, I get ERR_CONNECTION_REFUSED. How can I let it access the fake page, I have created.

P.S Though, I am able to catch all the SNMP packets, my router has been sending to the victim. (So, I suppose, ARP spoofing is correctly done.)

  • 1
    Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see code.google.com/p/chromium/codesearch#chromium/src/net/http/… - the same list is used by Firefox) and won't load if the certificate signer doesn't match the expected one. Try spoofing a smaller site - might well work. – Matthew Mar 11 '16 at 16:32
  • What if, I want to tackle that as well ? – Milind Purswani Mar 11 '16 at 16:41
  • 1
    Get a certificate signed by one of the CAs referenced in that file under Facebook - "SymantecClass3EVG3", "DigiCertECCSecureServerCA", "DigiCertEVRoot", or "FacebookBackup". You'd need to get an EV certificate based on the names, in order to have the right CA chain, which you shouldn't be able to do, unless you are actually a registered company called Facebook. It's almost exactly what it's designed to protect against. – Matthew Mar 11 '16 at 16:46
  • Ok, I guess, that was valid point. Another thing. How do I get css of orignal web page in my page? – Milind Purswani Mar 11 '16 at 16:50
  • @M.S.P You could also just redirect the user to faebook.com or something like that. – Apache Mar 11 '16 at 23:52
4

Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome source - the same list is used by Firefox) and won't load if the certificate signer doesn't match the expected one.

In order to defeat that, you would need to get a certificate signed by one of the CAs referenced in that file under Facebook - "SymantecClass3EVG3", "DigiCertECCSecureServerCA", "DigiCertEVRoot", or "FacebookBackup". You'd need to get an EV certificate based on the names, in order to have the right CA chain, which you shouldn't be able to do, unless you are actually a registered company called Facebook. It's almost exactly what it's designed to protect against.

You would probably be able to spoof a site which isn't on the HSTS preload lists with the settings you have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.