DNS Spoofing using Ettercap

DNS poisoning, also known as DNS cache spoofing, is an attack technique that can corrupt domain name systems, causing the name server to return an incorrect result record. This can lead to traffic being redirected to the attacker's system. An attacker can create a fake DNS entry, which can be malicious. For instance, when a user tries to visit a legitimate site like www.duckduckgo.com, they might be redirected to the attacker’s site instead of the actual legitimate site.

Example of DNS Poisoning with Ettercap

Here's a step-by-step guide on how to carry out DNS poisoning using Ettercap:

Step 1: Edit the etter.dns file

First, you need to edit the etter.dns file located in the /etc/ettercap directory. This file contains all entries for DNS addresses used by Ettercap to resolve URL addresses.

sudo vi /etc/ettercap/etter.dns

In this file, you can create your own DNS entry. For example, redirecting facebook.com to an IP address like 192.168.43.109 or redirecting google.com to another IP such as 104.215.148.63 (which is Microsoft.com). After making the necessary changes, save and exit the file.

Step 2: Launch Ettercap in Graphical Mode

Start Ettercap in graphical mode and begin sniffing the network. Navigate to the MITM (Man-In-The-Middle) menu and select ARP poisoning to initiate the ARP poisoning attack.

Refer to the whole ARP Poisoning using Ettercap Tutorial if you are unclear of how to do this first step.

Step 3: Start the dns_spoof Attack

After starting the ARP poisoning, navigate to the menu, select plugins, then manage plugins. Double click on dns_spoof to start the dns_spoof attack. Once activated, you can view the connections to verify if the attack was successful. For instance, you might observe a user trying to access facebook.com being redirected to your specified IP address, 192.168.43.109. Similarly, attempts to access google.com might redirect to 104.215.148.63.

Conclusion

DNS spoofing using Ettercap is a powerful technique that can be used for ethical hacking and penetration testing purposes. However, it's crucial to use this knowledge responsibly and ensure you have the necessary permissions before conducting any tests. Unauthorized DNS spoofing can lead to severe consequences, both legally and ethically. Always prioritize enhancing security over exploitation.