We will now discuss an important DNS attack name DNS spoofing slash cash poisoning.
You can use these words interchangeably DNS or domain name server is a piece of software that translates
human readable domain names such as Google dot com Facebook dot com to IP addresses that are used to
run communication over the Internet.
Normally if the server doesn't know request a translation it will ask the next DNS server to do this
translation for it and so on so forth.
This is called recursive this to increase the performance DNS servers usually cache these translations
locally for a certain period of time before it expires.
And this means the DNS server that caches these requests receive a similar request from the client next
time it will not go into the critical service or not forward the request to the next DNS server but
will reply directly from the cache.
So here is the vulnerability when a DNS server receives a false translation of a domain name to IP it
will cache this false translation for optimization purposes of course.
And now we consider the DNS server as being poisoned so it will supply the client with the wrong IP
address which is usually an attacker's IP address and a different type of attack the will stop.
So lets go directly to our candy machine here and do some examples.
For this purpose I've created a fake page on my local machine in which I will redirect the users to
its under var w w w h m l t list.
Here you will see the index will open the index the LS file and you will see that I've created a very
simple HDMI page.
Just with this sentence here you have been hacked.
So now whatever the user over time the client will type on his browser we will read that attend to the
speech we will use the took up application again but before going that let's do a couple of things we
have to do some configuration here Kate.
Each dot com.
That's the E dot com here.
So I'll copy it and we'll open it here.
So before you start with this attack make sure to change the UI the NGV to zero default configuration
starts with a 6 5.
So whatever number is here just make sure that it is zero so you can use this file.
Next thing we will as well locate the eater got DNS file copy again this file.
Open it.
Actually this is the file that would have the fake DNS entry.
So these are all commended entities.
You can see this file it has lots of translations.
We're interested in these translations so make sure to comment.
Microsoft dot com entries for the hostname just make the point are there without comment and add this
here.
So add a store.
So any course that comes here on creating a host entry and really like them to this IP which is the
local IP the local IP
and make sure to save the file and then close the file.
Now open the Ethan gap application
and then do sniffing on the interface then go and scan for the hosts.
Now we discovered these hosts and here we go.
These are the hosts available of the network.
We are targeting this machine which is the Windows 10 machine so added to the target and then go to
the M.I.T. M and press on the are poisoning the Fremont connections and start next we'll have to load
the DNS spoofing plugin and here you go.
Everything now is up and running.
If you go to the machine Windows machine and try to open the browser just type here.
W w w Google the com.
And here you go the DNS has been spoofed and you have been redirected to my own page here.
Another type of attack might kick in like we will see these attacks in the web application section.
You can create fake pages that similarly look like other famous pages etc..
So actually this kind of attack can be mitigated at the transport layer or application there by performing
end to end validation.
A common example is to use TRL s and digital signatures for example here.
If you open a page that have HD s you will not be able to perform this kind of attack like Facebook.
So this attack failed now because the user or the browser is checking whether the servers digital certificate
is valid before establishing the connection.
So this will not work.
This will only work on Web sites that do not use encryption.