1

I'm trying to create a fake DNS server by altering my router's DNS IP and redirect it to a fake facebook page using dnschef v0.2 and setoolkit 7.3. I have 2 machines. The first is the attacking computer. It is running Kali 2016.1 in VirtualBox 5.1.0r108711. I am hardwired into a TP-Link TL-WR840N router. The victim's computer is a Windows8.1 machine that is also hardwired into the router. I can't get my victim's computer to get the fake facebook.com. It just goes to the regular one. I've seen countless tutorials so I know what a working output of dnschef and setoolkit looks like. Below are the steps I took troubleshooting wise. Keep in mind this is a brand new install of Kali with default everything.

First things first, I went into my router and made my Primary DNS: 192.168.0.103 for my Kali local IP. And I made the secondary DNS 8.8.8.8 for Google's DNS.

I ran the command to start...

dnschef --fakeip=192.168.0.103 --fakedomains=facebook.com --interface=192.168.0.103

Looks normal. Then I ran dnschef in a new terminal tab.

Social Engineering>Website Attack Vectors>Credential Harvester Attack>Site Cloner. I used http://www.facebook.com with the IP 192.168.0.103.

I attempted to log into facebook with Internet Explorer on the Windows 8.1 target computer. Nothing happened. I just logged in like normal. I even opened up the harvester file manually. Nothing inside.

Now here's the interesting thing. I go to var/www/html/index.php and when I typed in my username and password, I was able to log the username and password with harvester. It works on my local machine but I can't get my second computer to see it.

When I do nslookup facebook.com on my Kali machine and my Windows machine, it returns my attacker's address as expective with the real IP as the "Non-authoritative answer. Which means it should be working right!?

I typed in 192.168.0.103 on my target computer and it found the fake page.

So I can conclude that my target computer is seeing facebook.com as my attacker's IP and I can also conclude that I can reach my webpage with my target computer manually. Which means it should have every reason to connect. Yet it is not. I am SOOOO CLOSE. What am I doing wrong!? Any of you guys have any ideas?

  • UPDATE: back to square 1. Now Windows 8.1 is not getting the fake page I want it to. Even after clearing the IE cache and the DNS cache. The target computer still crashes when I log in then out of the real facebook in IE. I also tried to log into my fake page locally with my Kali maching. It wrote to reaver just fine. What's going on!? – user21303 Aug 12 '16 at 6:03
  • Please do not include additional information in comments. You can edit your question and change or include all that is necessary. You don't need to write "update" either, SE keeps the edit history. – techraf Aug 12 '16 at 6:36
1

Ended up using Ettercap. Don't know what the problem was, but I've had nothing but success with various ettercap experiments and starting the apache servers manually.

0

If the file the dnschef created is called harvester_2016-08-12 01:20:40.379582.txt, you cannot write the commands as follows:

tail ./harvester_2016-08-12 01:20:40.379582.txt
chmod 777 ./harvester_2016-08-12 01:20:40.379582.txt

Because it will pass two arguments to the tail or chmod:

harvester_2016-08-12
01:20:40.379582.txt

Neither of the above files exists and the commands rightfully return errors.

You need either to quote the whole path or escape the space character:

tail "harvester_2016-08-12 01:20:40.379582.txt"
tail harvester_2016-08-12\ 01:20:40.379582.txt
  • Thanks. I got that fixed. But I still need to have my target see the fake page. I think something is wrong with dnschef. – user21303 Aug 12 '16 at 7:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.