Hello and welcome to another tutorial on wireless networks, although today this method can be used on wired networks as well!
Me and ac1dxtrem may one day incorporate all of our tutorials and scripts in to an ebook/bundle of sorts, we are unclear on what it will be but we know that we want to do something so we are outputting lots of stuff that you guys might find interesting and useful!
Ok so today's attack will be performed on my home wireless router, and I will be using Ubuntu 10.10 to perform the attack. I have just installed Ubuntu 10.10 so i will cover the packages that need to be installed to get this working as i have to do it myself!
If you are on Backtrack then these tools will already be included in your files so no need to worry about installation.
About the attack
ac1dxtrem has made a thread about the basics of this attack so i suggest you read that first; you can find it here
If you aren't that interested in the theory and just want to know how this attack can be done, then firstly i highly recommend you rethink your attitude towards hacking and secondly here is a very basic introduction to what will be done.
This is a very simple attack and you can make a bash script that performs it in 5 lines of code, and it is relatively easy to set up. What the end result of a DNS spoofing attack does is redirect all of the traffic on a network to a different IP address. So people trying to access "www.google.com" (173.194.37.104) will be redirected to XX.XX.XX.XX and you get to define that IP address.
What will we use?
To do this we will use a program called ettercap; ettercap is a utility that allows users an easy method of performing MITM attacks. Today though we are interested in the DNS spoofing capabilities of ettercap's DNS spoof plugin. This is very simple to set up although depending on what you want to do you can make it harder or easier.
Why will we use it?
Well first and foremost i think is simply 'teh lulz'. What i mean by this is that you can redirect all of the traffic on a network to a web page, and that web page could be a shock website, or a deface page, the ides of this is just to pwn a network and see the amount of humour that would arise. This is also quite a good thing to do as it isn't going to get you in as much trouble as some of the other methods. This is also easier to set up than other methods.
Another technique that uses DNS spoofing, is one that redirects traffic to a web page that prompts the user to download a "file". The file if of course your RAT/Keylogger/Stealer/Bot. There is already a detailed tutorial about this technique written by SB91 here
However the most infamous method is one that involves phishing. As this is against the forum rules (and i am not 100% able to do it as i have never tried) i will not go into detail about this method. I will leave it up to you to work it out, if you are really interested in it. But please do not ask me (I will report you) or post on this forum about it as it is illegal black hat activity!
Getting ettercap
OK so for this tutorial i am running Ubuntu 10.10, if you are running a linux distro you should be able to follow these instructions, if you are on Backtrack you already have it. In a terminal type
This will install ettercap to you machine very easily! Just enter y if it prompts you. To test if it is installed type:
That will display the version.
If you are on Windows or Mac you will have to install this yourself, have a look here
So how do i use this shiny new bit of software?
The answer is simple, as there are very few steps required to DNS spoof a network. We need to find 2 things first though, the gateway IP of the network and the interface that we are using. There are half a dozen ways to find these bits of info but the easiest command to use is probably:
This will display an out put like this:
What you see there is the gateway IP (192.168.1.254) and the Interface (wlan0). Yours could be different but that is the easiest way to find them. There are other ways to do it, but this is the most simple.
OK now we know our gateway and our interface, for me it is:
Gateway: 192.168.1.254
Interface: wlan0
Now we can use these in our next commands. The next part of this is to define where we are going to redirect the traffic. This needs to be in IP format. This means that you need to find a website that has a dedicated IP address and you are OK to redirect traffic to the home page. Alternatively you can set up an apache server and redirect traffic to there. I will cover that later, but for the moment let us get a proof of concept example going first.
Setting up the redirection rules
In my example i will redirect traffic to hackforums.net. So i need to find out the IP of hackforums.net there are many ways to do this but the easiest to explain in a tutorial is this:
That will put the IP of the website you put in hackforums.net's place. It is a tad long, but if you are making notes like you should be you can copy pasta it. Or just learn how to use ping it is VERY simple.
So hackforums IP is: 69.162.82.251
Now i advise at this point that you check that you ensure that that IP address resolves to where you want it to go to. So open up your browser (firefox) and put the IP address in the address bar. If you get the web page you want to redirect to then you are set!
Now we just need to put that information into out ettercap configuration. We do this with this line of code:
You obviously replace 69.162.82.251 with the IP you wish to redirect to. Now lets have a look at this command. All it does is (over)write '* A 69.162.82.251' to ettercaps dns configuration file. The means ALL traffic, the A means redirected to, and the IP is where it is redirected to. So if you put:
'google.com A 69.162.82.251' in you would redirect all of the clients trying to connect to google.com to 69.162.82.251.
This is also where you would enter the IP if you wanted to redirect traffic to a machine on the internal network, for example:
A 192.168.1.70
Would direct traffic to 192.168.1.70. I will cover why you might want to do this later on in the tutorial.
Running ettercap
Now we just need to run ettercap here is the command that i will be using in my example:
OK now to break this down:
ettercap = Run ettercap
-T = Run ettercap in text only mode
-q = Run in quiet mode (Only important info shown)
-i <interface> = This is where we specify the interface so '-i wlan0' means "use wlan0" this is where you put your interface that you found earlier with route -n
-M arp:remote = Mode; arp-remote (begin arp-poisoning the network)
/<gateway>/ = Become the Man in the Middle to the gate way specified (This is where you put in the gateway you found with route -n earlier and...
// = Become the MITM for all clients of the gateway. You can optionally specify a specific client to target here by adding their internal IP in like this /<internal IP>/ You can find internal IP with nmap, but that is not for now....
Result?!
Well you should hopefully see something a little like this:
Now you can see all of the websites being redirected to hackforums.net!
When you are finished press 'q' to quit.
Now that is the basics of using ettercap to DNS spoof, now i will talk about setting up an apache server on your computer and redirecting traffic to that. The benefit of this is that you make the webpage that the victims are redirected to.
Setting up apache
Now basically we use exactly the same methodology as before but we are creating the page that has been redirected to. First of all you need to install apache, so in a terminal type:
Press yes if it asks you for it, and then you have it installed. Next you need to test if it is working. So begin apache2 like this:
Then open your browser put 127.0.0.1 in the address bar. You should see a page that says 'It works!' This is your web page now. You can edit it by going:
Now you make your web page from there. I suggest something like this
So now when you navigate to 127.0.0.1 you should see your web page in all its glory. now all you need to do is replace the IP address that you are spoofing to, to your internal IP address. You can find your internal IP address with this command:
Now you just put it in your ettercap configuration like as before:
Then test that apache is running and your webpage can be accessed by going to 127.0.0.1 then just run ettercap exactly as before, and the traffic will go to you instead of the IP of the website!
Tada!
So in very short this can be down with just 4 commands:
I hope you have enjoyed!
Here is a list of my other tutorials and scripts:
https://hackforums.net/showthread.php?tid=896006
Me and ac1dxtrem may one day incorporate all of our tutorials and scripts in to an ebook/bundle of sorts, we are unclear on what it will be but we know that we want to do something so we are outputting lots of stuff that you guys might find interesting and useful!
Ok so today's attack will be performed on my home wireless router, and I will be using Ubuntu 10.10 to perform the attack. I have just installed Ubuntu 10.10 so i will cover the packages that need to be installed to get this working as i have to do it myself!
If you are on Backtrack then these tools will already be included in your files so no need to worry about installation.
About the attack
ac1dxtrem has made a thread about the basics of this attack so i suggest you read that first; you can find it here
If you aren't that interested in the theory and just want to know how this attack can be done, then firstly i highly recommend you rethink your attitude towards hacking and secondly here is a very basic introduction to what will be done.
This is a very simple attack and you can make a bash script that performs it in 5 lines of code, and it is relatively easy to set up. What the end result of a DNS spoofing attack does is redirect all of the traffic on a network to a different IP address. So people trying to access "www.google.com" (173.194.37.104) will be redirected to XX.XX.XX.XX and you get to define that IP address.
What will we use?
To do this we will use a program called ettercap; ettercap is a utility that allows users an easy method of performing MITM attacks. Today though we are interested in the DNS spoofing capabilities of ettercap's DNS spoof plugin. This is very simple to set up although depending on what you want to do you can make it harder or easier.
Why will we use it?
Well first and foremost i think is simply 'teh lulz'. What i mean by this is that you can redirect all of the traffic on a network to a web page, and that web page could be a shock website, or a deface page, the ides of this is just to pwn a network and see the amount of humour that would arise. This is also quite a good thing to do as it isn't going to get you in as much trouble as some of the other methods. This is also easier to set up than other methods.
Another technique that uses DNS spoofing, is one that redirects traffic to a web page that prompts the user to download a "file". The file if of course your RAT/Keylogger/Stealer/Bot. There is already a detailed tutorial about this technique written by SB91 here
However the most infamous method is one that involves phishing. As this is against the forum rules (and i am not 100% able to do it as i have never tried) i will not go into detail about this method. I will leave it up to you to work it out, if you are really interested in it. But please do not ask me (I will report you) or post on this forum about it as it is illegal black hat activity!
Getting ettercap
OK so for this tutorial i am running Ubuntu 10.10, if you are running a linux distro you should be able to follow these instructions, if you are on Backtrack you already have it. In a terminal type
Code
sudo apt-get install ettercapThis will install ettercap to you machine very easily! Just enter y if it prompts you. To test if it is installed type:
Code
ettercap -vIf you are on Windows or Mac you will have to install this yourself, have a look here
So how do i use this shiny new bit of software?
The answer is simple, as there are very few steps required to DNS spoof a network. We need to find 2 things first though, the gateway IP of the network and the interface that we are using. There are half a dozen ways to find these bits of info but the easiest command to use is probably:
Code
route -nThis will display an out put like this:
[img]http://i.min.us/ib4YN6.png[/img]
What you see there is the gateway IP (192.168.1.254) and the Interface (wlan0). Yours could be different but that is the easiest way to find them. There are other ways to do it, but this is the most simple.
OK now we know our gateway and our interface, for me it is:
Gateway: 192.168.1.254
Interface: wlan0
Now we can use these in our next commands. The next part of this is to define where we are going to redirect the traffic. This needs to be in IP format. This means that you need to find a website that has a dedicated IP address and you are OK to redirect traffic to the home page. Alternatively you can set up an apache server and redirect traffic to there. I will cover that later, but for the moment let us get a proof of concept example going first.
Setting up the redirection rules
In my example i will redirect traffic to hackforums.net. So i need to find out the IP of hackforums.net there are many ways to do this but the easiest to explain in a tutorial is this:
Code
ping -c 1 hackforums.net | grep 'PING' | sed s/"("// | sed s/")"// | sed s/":"// | awk -F' ' '{ print $3}'That will put the IP of the website you put in hackforums.net's place. It is a tad long, but if you are making notes like you should be you can copy pasta it. Or just learn how to use ping it is VERY simple.
So hackforums IP is: 69.162.82.251
Now i advise at this point that you check that you ensure that that IP address resolves to where you want it to go to. So open up your browser (firefox) and put the IP address in the address bar. If you get the web page you want to redirect to then you are set!
Now we just need to put that information into out ettercap configuration. We do this with this line of code:
Code
sudo echo "* A 69.162.82.251" >> /usr/share/ettercap/etter.dnsYou obviously replace 69.162.82.251 with the IP you wish to redirect to. Now lets have a look at this command. All it does is (over)write '* A 69.162.82.251' to ettercaps dns configuration file. The means ALL traffic, the A means redirected to, and the IP is where it is redirected to. So if you put:
'google.com A 69.162.82.251' in you would redirect all of the clients trying to connect to google.com to 69.162.82.251.
This is also where you would enter the IP if you wanted to redirect traffic to a machine on the internal network, for example:
A 192.168.1.70
Would direct traffic to 192.168.1.70. I will cover why you might want to do this later on in the tutorial.
Running ettercap
Now we just need to run ettercap here is the command that i will be using in my example:
Code
ettercap -T -q -i wlan0 -M arp:remote /192.168.1.254/ // -P dns_spoofOK now to break this down:
ettercap = Run ettercap
-T = Run ettercap in text only mode
-q = Run in quiet mode (Only important info shown)
-i <interface> = This is where we specify the interface so '-i wlan0' means "use wlan0" this is where you put your interface that you found earlier with route -n
-M arp:remote = Mode; arp-remote (begin arp-poisoning the network)
/<gateway>/ = Become the Man in the Middle to the gate way specified (This is where you put in the gateway you found with route -n earlier and...
// = Become the MITM for all clients of the gateway. You can optionally specify a specific client to target here by adding their internal IP in like this /<internal IP>/ You can find internal IP with nmap, but that is not for now....
Result?!
Well you should hopefully see something a little like this:
"It was big so i hid it" (Click to View)
Now you can see all of the websites being redirected to hackforums.net!
When you are finished press 'q' to quit.
Now that is the basics of using ettercap to DNS spoof, now i will talk about setting up an apache server on your computer and redirecting traffic to that. The benefit of this is that you make the webpage that the victims are redirected to.
Setting up apache
Now basically we use exactly the same methodology as before but we are creating the page that has been redirected to. First of all you need to install apache, so in a terminal type:
Code
sudo apt-get install apache2Press yes if it asks you for it, and then you have it installed. Next you need to test if it is working. So begin apache2 like this:
Code
sudo /etc/init.d/apache2 startThen open your browser put 127.0.0.1 in the address bar. You should see a page that says 'It works!' This is your web page now. You can edit it by going:
Code
sudo gedit /var/www/index.html &Now you make your web page from there. I suggest something like this
So now when you navigate to 127.0.0.1 you should see your web page in all its glory. now all you need to do is replace the IP address that you are spoofing to, to your internal IP address. You can find your internal IP address with this command:
Code
ifconfig | grep Bc | awk -F " " '{print$2}'Now you just put it in your ettercap configuration like as before:
Code
sudo echo "* A 182.168.1.70(your internal IP)" >> /usr/share/ettercap/etter.dnsThen test that apache is running and your webpage can be accessed by going to 127.0.0.1 then just run ettercap exactly as before, and the traffic will go to you instead of the IP of the website!
Tada!
So in very short this can be down with just 4 commands:
Code
gateway=$(route -n | grep -v Gateway | head -n 5 | tail -n -1 | awk -F " " '{print $2}' )
interface=$(route | grep -v Gateway | head -n 5 | tail -n -1 | awk -F " " '{print $8}' )
/etc/initd./apache2 start (Optional)
echo "* A <IP TO REDIRECT TO>" >> /usr/share/ettercap/etter.dns
ettercap -T -q -i $interface -M arp:remote /$gateway/ // -P dns_spoofI hope you have enjoyed!
Here is a list of my other tutorials and scripts:
https://hackforums.net/showthread.php?tid=896006
