I guess this is not considered a true MITM attack since the attacker does not have to be between the server and client. My question is how it is possible to poison a DNS cache, and redirect traffic to your computer that is hosting a proxy that then forwards traffic to the actual web server? I wanted to simulate an such an attack by setting up BIND on my network but I'm not sure how to configure a proxy like paros to forward traffic to a specific web server. For example, I will run Apache on 192.168.1.2 which will host www.example.com on my LAN, BIND on 192.168.1.2, and Paros on 192.168.1.3. I will then use Kaminsky's improved birthday attack to poison the cache of the bind server which will redirect all queries of www.example.com (192.168.1.2) to 192.168.1.3 which runs Paros. I can do everything up to this point, but I don't know how to properly configure Paros to then forward traffic to the actual web server @ 192.168.1.2 whenever www.example.com is queried by another host on my network.
This is not exactly what you were asking for, and I'm not sure if it's close enough...
But you can look up DNS Rebinding, which effectively does something very similiar (perhaps a bit in reverse), in a very simple way.
From the linked wikipedia article:
The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the internet.
Specifically to what you were asking, if a DNS server or client is not configured correctly, they may accept DNS responses, even if they did not originally send that request. In that case, it would be possible to send an arbitrary DNS record, that will be cached and saved by the DNS server.
I do not know how common this is anymore, as I'm pretty sure most common DNS packages prevent this by default.