Target Machine: VM on my network, on a machine that is hardwired to the router

Kali Box: Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both within the same network




Address to redirect to: (my blog)

Steps taken to spoof dns:

  1. Setup traffic forwarding on my kali box

echo 1 > /proc/sys/net/ipv4/ip_forward

  1. arp poison the gateway

arp -i wlan0 -t

  1. arp poison the target

arp -i wlan0 -t

  1. create a host file (using tab in between the ip and the url)

cat > host *.google.com *.facebook.com *.bing.com

  1. start dns spoof

dnsspoof -i wlan0 -f host


When I use NSLOOKUP at retrieve the DNS records for my target sites the expected ip of is returned. However when you go to the target sites in the browser it just times out.

enter image description here

When the target machine calls one of the target sites I can see dnsspoof logging the traffic.

enter image description here


As noted above, when you navigate to the target sites in the browser the request times out even though NSLOOKUP is returning the proper redirect ip.

  • Although your screenshots are hard to read, the two sites I see, www.google.com and www.facebook.com, are both on the HSTS preload list, and HTTPS (443) to your site apparently times-out (it does so from my ISP at least). Sep 20, 2016 at 10:58
  • Oh interesting. I didn't realize it was attempting to forward to port 443. Is there a way to switch it to port 80? @dave_thompson_085 Sep 20, 2016 at 11:01
  • 1
    To get a browser to send http to an HSTS host you'll have to patch the browser. Firefox and Chrome are open s9urce, but pretty big and complicated; if you're a very good programmer maybe a few weeks. (2) A nonbrowser client like curl or wget doesn't do HSTS and will send the request fine, but the results will be very hard to read. (3) You could set up an HTTP proxy so the browser thinks it is connecting to say myfake.local which has no HSTS and the proxy tries to relay to www.google.com which you spoof. Apache or nginx can do this, and maybe Squid or Burp etc.... Sep 21, 2016 at 13:50
  • ... (0) But easier just use a host not set for HSTS in the first place, as you already found. Sep 21, 2016 at 13:51
  • @dave_thompson_085 that's the direction I needed. Thank you, I will look into HTTP proxy next Sep 21, 2016 at 13:51

1 Answer 1


So the answer was obvious I suppose but I still don't know how to work around this.

When the target machine was requesting a site such Facebook.com it was doing it over HTTPS obviously. Which I guess meant it expected the site returned to accept a HTTPS connection.

This means that if I wish to DNS Spoof and forward the target machine to a different site that (at least for the moment until I figure out a work around) it needs to accept the same protocol that was initially requested.

To test this theory I found a site that allows HTTP connections (MSN.com) and I instead returned my blog. This worked swimmingly.


So the short answer to the above problem was that I was attempting to forward the target to a machine that didn't support HTTPS though that's what the target machines initial request was for.

By using a site that accepted HTTP requests I was able to confirm this was the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .