4

Preface: I had an argument with a buddy the other day, he said it was impossible I disagreed. So say I have a large network of computers all visiting the same website for some reason. Then I have a DNS redirect from login.php (The original site). I will supply a fake login page from my own apache server (fake.php). Is there a way to stop the spoof or redirect in a way that it wont be intercepted and spoofed again when a user logs in?

So the user goes to login.php
User is redirected to fake.php
Types in fake credentials
***Redirects to login.php to login for real this time.
***End spoofing for that specific IP, or redirect in a way where the user wont be spoofed again.

The only problem is if I do redirect to login.php after a login it will be spoofed again! Is there any way to stop this? I thought about not using UDP port 53 (Which is what MITMF's DNS plug in uses). But how can I redirect then? Direct GET/POST data and print the output externally?

I am using MITMF with arp and dns spoof. Any Ideas?

Improve this question

1 Answer 1

Reset to default
1

Interesting question. If i understand correctly: fake.php is the frontend to login.php on the main server, and you are spoofing both.

If i am, then:

I would record the user's internal IP, and credentials, then store it. if the ip that visits login has been there before, forward the data to the real server. If the password is correct (check using some kind of regex kung-fu), great, step out of the equation. If it isn't, forward the incorrect password page and go back to fake.php, repeat the process and replace the incorrect credentials stored with the correct ones.

I would personally recommend using scapy or bettercap.

Improve this answer
24
  • In theory it would run over a large network so I would keep it running non-stop. So how could I stop spoofing that specific I.P?
    – Creg
    Oct 7, 2016 at 2:27
  • You don't, instead, you act as a normal proxy.
    – dGRAMOP
    Oct 7, 2016 at 2:28
  • Basically, you don't replace the page for him.
    – dGRAMOP
    Oct 7, 2016 at 2:29
  • But how MITMF and BETTERCAP's DNS redirect will auto redirect the DNS query when found. So if I redirect the user to the original site to login for real, their DNS query will be spoofed again. So it becomes a infinite loop.
    – Creg
    Oct 7, 2016 at 2:33
  • 1) Why are you using both arp and dns
    – dGRAMOP
    Oct 7, 2016 at 2:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.