MITM/DNS
From charlesreid1
DNS Attacks
So what is DNS anyway? DNS is domain name resolution protocol - it's how names like "yahoo.com" get turned into IP addresses like "10.20.30.40". It's a fundamental part of the way the internet routing system works.
DNS Hijacking
DNS hijacking consists in an attacker hijacking DNS traffic from the sheep in order to maliciously redirect the sheep to servers of our own choosing.
This is typically achieved at Level 3 and 4 on a network: ARP spoofing to redirect a sheep's traffic through the attacker, and a DNS server to handle requests (to send the sheep to our malicious server) or forward requests on to other DNS servers to take care of. However, it can also be achieved at the physical layer, by modifying the filesystem of a sheep's computer to permanently point to a pirate DNS server.
This type of attack can be carried out with the Bettercap tool. See below or Bettercap#DNS Spoofing.
Tools
Bettercap
Yep, Bettercap can execute MITM DNS attacks. This consists of two steps:
- Define your malicious DNS entries
- Execute your bettercap DNS attack
This will perform DNS spoofing, meaning Bettercap will trick the sheep into sending all of its DNS requests to the attacker instead of to the gateway. This allows the attacker to hijack traffic to certain sites.
When a DNS attack is combined with the HTTP proxy for traffic modification, this allows you to man-in-the-middle a DNS request for a particular domain (say, Microsoft.com), redirect the traffic through the HTTP proxy, and modify either the traffic sent from the sheep to the server, or from the server to the sheep.
See the Bettercap page for more detailed notes.
EvilFOCA
Windows tool
Link: https://github.com/ElevenPaths/EvilFOCA
Tool for conducting various DNS attacks (and other types of attacks)
- Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server
- DNS Hijacking - hijacking the sheep's DNS channel to control where the sheep's requests point them
Flags
 |
monkey in the middle attacks in which an attacker tricks two parties into thinking they're communicating with each other, but both are communicating with the attacker.
Wireless Attacks: MITM/Wireless Wired Attacks: MITM/Wired
Layer 1 and 2 MITM Attacks: Network Tap: MITM/Wired/Network Tap Evil Twin Attack: Evil Twin · MITM/Evil Twin
Layer 3 and 4 MITM Attacks:
ARP Poisoning: MITM/ARP Poisoning Traffic Injection/Modification: MITM/Traffic Injection DNS Attacks: MITM/DNS · Bettercap/Failed DNS Spoofing Attack · Bettercap/Failed DNS Spoofing Attack 2 DHCP Attacks: MITM/DHCP WPAD MITM Attack: MITM/WPAD Port Stealing: MITM/Port Stealing Rushing Attack: MITM/Rushing Attack Attacking HTTPS: MITM/HTTPS
Session Hijacking: MITM/Session Hijacking
Toolz:
SSLSniff · SSLStrip · Frankencert
MITM Labs: {{MITMLabs}}
Category:MITM · Category:Attacks · Category:Kali Attack Layers Template:MITMLabs · Template:MITMFlag Flags · Template:MITMFlag · e |