Welcome to this tutorial. Today, I will show you how to mess around with
the DNS settings, and how you can actually redirect the traffic of a
particular user to somewhere, I don't know, to where you want your malicious
site, where you can deploy exploits, and so on and so forth. Anyway, what I mean by
this is that somebody will enter a domain name into a browser, let me just
show you. So, open up a browser like this, and it's a bit slow today,
probably because I have 10 billion things running. Anyway, you would type in,
I don't know, let's say double www.facebook.com, because we're gonna use this
as our experimental site for today's work. Primarily because it has really
good security, but we're not going to do anything to facebook.com, anyway, to the
official domain. A person will enter a domain name like this, and instead of
being redirected to the proper IP address, they will be redirected to some
IP address that we type in. So our IP address where there will be a web server
listening to receive that traffic, and once that traffic is received they will
get an exact clone of the website where they will be entering their credentials.
Once they actually have entered them we will have them, and we will be able to do
with them as we choose. And please, now this is just an example of how things
can run, not necessarily that they will run in all cases, and specific cases may
require adjustments, so to say, depending on what sort of a site is it, how
to approach it, and so on and so forth. Anyway, so for the purposes of this
tutorial I have two virtual machines,
one is Kali Linux, and the other one shall be my Windows 8.1 machine. That
will be a victim. You don't have any real machines here to test it out on, like
test it out on three or four different real machines, but it doesn't matter.
It really doesn't matter. The procedure is exactly the same, there are literally
no differences, and the best part is that you can
actually combine the stack technique with some of the things that we have
learned in the previous tutorials. For, example this technique can also be
combined with SSL strip, although that's a bit more of a complex method, or that
requires a bit more complexity to it. Anyway, let me just boot this machine up.
And while that is booting, let us go over to our Kali Linux box. I'm going to go
ahead and log in here, and it looks like Guest Additions broke. Oh, no, I have a full
screen. It just takes a bit to load, because I am running several virtual
machines at once. Now there are several tools which we will need, fortunately for
us we don't actually need to install anything. All these things come
pre-installed with Kali Linux. If you want to use a different Linux distro, you
can install these things, it's nothing too difficult, or anything of a
kind. They're pretty easy to install. You can find them on the net, and the
official sites, and download and install them from there. I am disconnected, why am
I disconnected? Let's have a look at the network settings. Of course,
because I'm going over wireless, and I'm not connect to the wired network.
Anyway, make sure that your virtual machine is actually connected to the net
and that you have access to it. I will have it in a moment, and there we go. Let
me just confirm that I have access to the net. But, even if I don't, I should be
able to do this. However, you won't be able to do this externally if you don't
have access to the Internet. Let's just try to ping google.com. Excellent! So I'm
getting a reply, I am connected. Anyway, now that we have our Kali Linux
running, and in the previous tutorials we have actually managed to compromise a
router, so by utilizing that router we're gonna effectively change its DNS
settings. We will tell it that the DNS is actually our virtual machine, and as soon
as this browser opens I'll show you what I mean by it.
Oops, there we go. Come on...
192.168.1.1. We we have already gotten the user credentials in
the previous tutorials, here we're just gonna apply them, and there we go. Let me
just zoom it in for you. So this is the interface of a tp-link router, and there
are lots of settings here. But, we are interested in the DNS settings, and let
me just find them to see where they are. You will encounter a lot of
things in these routers. You will encounter different
configurations, different setups, and it sometimes can get a bit tiring to
actually find where is what. Now in an advanced setup you have a firewall. Now if
you already breached the router you can actually disable a firewall,
which is fantastic. So, even the ping of death will fly if the firewall isn't up
and running. I suspect that is true as the firewall was the only
thing blocking it here, as far as I can see. Now you have a lot of other things.
You have nat, you have routing to see who is connected, other things as well.
You have VLAN, you can go into ADSL and actually figure out the credentials
there as well. But, we are not interested in any of those things. We are at the
moment looking for the dns settings, and I suspect I might find it here under
internet, get IP address, static IP, Gateway, not default route, TCP
encapsulation, service bridge, ISP, virtual circuit. Okay, apparently it is
not here. Let's go to the next one. It says, ah, there we go. So it says use
auto discovered DNS server only, and I do not want that. I don't want that to
happen. I want to use user discovered DNS servers only, to give me an option for
myself to type in whatever I want. And I'm going to type in the IP address of
my virtual machine. You can get it by typing an ifconfig.
excellent, there we go. So this is the IP address. Now these IP addresses
are dynamic, and hopefully they won't change for the duration of this tutorial.
In order to perform this attack on a larger scale, if you want to
remotely do this, because this attack is actually meant to be done on a remote
basis. So let's say that you're somewhere in Europe, and somebody else is in
eastern Russia, or something like that, you would be able to do this but you
would need to have a static public IP address. Not necessarily even static, but
you would need to do significant configuration to your router in order
to be able to do this. However, I recommend for the ease of use just to
get a VPN, and I have described how to use VPNs in the previous tutorial. So you
can go back there and figure out how to use a VPN, and once you have a VPN static
IP address, then you can actually perform this attack on great distances outside
of local networks. I will type in this server here. And once you actually type
in your fake DNS server that you will create the IP address of that server, it
is always a good idea to have a fallback here. So the fallback here will be
8.8.8.8. These are public Google DNS servers you,
can all feel free to use them. That's why they're there. They're
pretty good, actually. Open DNS and Google DNS servers, those are the two best DNS
servers out there in the world, as far as I know, and people tend to use them as
they are quite secure. The reason why I'm putting the second method here is that
you are not going to have this server of yours running non-stop. You want to run
it for a certain period of time, get what you need, and then you might want to turn
your machine off, or something like that. And once you do that, your victim
will be unable to browse the web, and you will raise suspicion, you will raise a lot
of red flags, and that can be extremely problematic. That's
definitely something you want to have here so it can
keep on functioning, even if your fake DNS server is not functioning. Click Save
and wait for it. It's gotta save eventually. These routers are not
state-of-the-art and they're they tend to be kind of slow, so keep that in mind.
Don't immediately be frustrated if it doesn't work out the
first time, just try it a couple of times and it should work just fine. Let me just
go ahead and clear this screen. Now in the next tutorial, in the follow up
tutorial, we will actually employ some tools and see what we can do with them.
Until then, I bid you farewell, and I hope to see you in the next follow up
tutorial.