I'm trying to create a fake DNS server by altering my router's DNS IP and redirect it to a fake facebook page using dnschef v0.2 and setoolkit 7.3. I have 2 machines. The first is the attacking computer. It is running Kali 2016.1 in VirtualBox 5.1.0r108711. I am hardwired into a TP-Link TL-WR840N router. The victim's computer is a Windows8.1 machine that is also hardwired into the router. I can't get my victim's computer to get the fake facebook.com. It just goes to the regular one. I've seen countless tutorials so I know what a working output of dnschef and setoolkit looks like. Below are the steps I took troubleshooting wise. Keep in mind this is a brand new install of Kali with default everything.
First things first, I went into my router and made my Primary DNS: 192.168.0.103 for my Kali local IP. And I made the secondary DNS 126.96.36.199 for Google's DNS.
I ran the command to start...
dnschef --fakeip=192.168.0.103 --fakedomains=facebook.com --interface=192.168.0.103
Looks normal. Then I ran dnschef in a new terminal tab.
Social Engineering>Website Attack Vectors>Credential Harvester Attack>Site Cloner. I used http://www.facebook.com with the IP 192.168.0.103.
I attempted to log into facebook with Internet Explorer on the Windows 8.1 target computer. Nothing happened. I just logged in like normal. I even opened up the harvester file manually. Nothing inside.
Now here's the interesting thing. I go to
var/www/html/index.php and when I typed in my username and password, I was able to log the username and password with harvester. It works on my local machine but I can't get my second computer to see it.
When I do
nslookup facebook.com on my Kali machine and my Windows machine, it returns my attacker's address as expective with the real IP as the "Non-authoritative answer. Which means it should be working right!?
I typed in 192.168.0.103 on my target computer and it found the fake page.
So I can conclude that my target computer is seeing facebook.com as my attacker's IP and I can also conclude that I can reach my webpage with my target computer manually. Which means it should have every reason to connect. Yet it is not. I am SOOOO CLOSE. What am I doing wrong!? Any of you guys have any ideas?