I'm trying to create a more practical DNS Hijack MITM attack. I do the traditional ARP poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly as expected. The only issue is that the current method isn't realistic. It would make a victim extremely suspicious because every other website would break. An attacker would need to count on the victim going to your domain immediately after you initiate the attack.

ALL websites not listed in the etter.dns host file gets redirected as well. How can we get ettercap to spoof ONLY the websites listed in etter.dns while forwarding everything else to their intended locations?

1 Answer 1


Comment out the following lines in /etc/ettercap/etter.conf

redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport" 

redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Note: You will need these lines uncommented if you plan on running SSLStrip.

  • what is the technical effect of uncommenting these lines?
    – schroeder
    Jul 24, 2022 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .