Suppose Victim A has your standard off-the-shelf Linksys wireless router which, by default, doesn't have encryption enabled on the wireless network which it broadcasts. Suppose Victim A never changed the default administration password either to gain access into the router's web interface to change settings (usually admin, admin).
These two situations are extremely common. All that Attacker A needs to do is setup a rogue DNS and web server on his laptop that has been connected to Victim A's wireless network, add forwarder addresses into his rogue DNS server (such as Google's public DNS of
184.108.40.206) so that all other domains Victim A tries to visit are still resolvable to their corresponding public IP address, then add a forward lookup zone for
facebook.com. Each of these 2 zones will need an A record for the root domain and an A record for
www both of which point to Attacker A's local IP address of
192.168.1.1. Attacker A then logs in to the router's web interface (the default gateway address - usually
192.168.1.1 for Linksys). From there, Attacker A changes the ISP DNS settings on the WAN interface from the settings obtained via DHCP from the ISP to his laptop's local LAN address (say for example
Now, on Attacker A's local web server, he takes Facebook's CSS stylesheets and login form with
wget or any other website mirror tool, then injects some PHP into the downloaded page that saves a text file to his local web server's root directory that records any username and password submitted via the form. Bear in mind that this form looks exactly like Facebook's login form. From there, the attacker forwards this information to the real Facebook site and logs the user in so the user never even knows what happened.
When Victim A visits
www.facebook.com, the IP address with resolve as Attacker A's laptop LAN address of
192.168.1.101 given Victim A's DNS cache has been cleared after a period of time.
As mentioned, the only downside is that if Victim A has https://facebook.com bookmarked, the process will look extremely (ph)ishy as Victim A will get an invalid certificate warning. Also keep in mind that the attacker doesn't have to stick around for this entire process if he sets up a rogue DNS and web server on a public IP, forwards ports 53 and 80 on his firewall, and sets Victim A's router DNS address to Attacker A's public IP.