Hello everybody and welcome to this tutorial.
Today I will show you how to mess around with the DNS settings and
how you can actually redirect the traffic of a particular user to somewhere,
I don't know, to wherever you want,
to your malicious site where you can deploy exploits and so on and so forth.
What I mean by this is that somebody will enter a domain name into a browser.
Let me just show you.
Open up a browser like this.
It's a bit slow today.
Probably, because I have ten billion things running.
Anyway, you would type in.
I don't know let's see, www dot facebook dot com,
cuz we're gonna use this as our experimental site for today's work,
primarily because it has really good security.
But we're not going to do anything to facebook dot com anyway,
to the official domain.
Person will enter a domain name like this and
instead of being redirected at a proper IP address they will
be redirected to some IP address that we type in.
So our IP address where there will be a web server
listening to receive that traffic and once that traffic is received they will get
an exact clone of the website, where they will be entering their credentials.
Once they actually have entered them, we will have them, and
we will be able to do with them as we choose and please.
Now this is just an example of how things can run, not necessarily that they will
run in all cases, and specific cases may require adjustments, so to say.
Depending on what sort of site is it, how to approach it, and so on and so forth.
Anyway, for the purposes of this tutorial, I have two virtual machines.
One is Kali Linux and the other one shall be my Windows 8.1 machine.
That will be a victim.
Don't have any real machines here to test it out on, like test it out on three or
four different real machines, but it does not matter.
It really doesn't matter.
The procedure is exactly the same.
There are literally no differences, and
the best part is that you can actually combine this technique with some
of the things that we have learned in the previous tutorials.
For example, this technique can be also combined with SSL strip,
although that's a bit more complex method, that requires a bit more complexity to it.
Anyway, let me just boot this machine up.
And while that is booting let us go over to our Kali Linux box.
I'm gonna go ahead and log in here, and it looks like the guest edition's broke,
oh, no, I have a full screen.
It just takes a bit to load because I am running several virtual machines at once.
Now there are several tools which you will need.
Fortunately for us we don't actually need to install anything.
All these things come pre-installed with Kali Linux.
If you want to use a different Linux this you can install these things.
It's not a, it's nothing too difficult or anything.
Their pretty easy to install.
You can find them on the net,
and the official site and download and install them from there.
I am disconnected. Why am I disconnected?
Let's have a look.
Network > Network Settings.
Of course, because I'm doing over wireless, and
I'm now connected to the wire network.
Anyway, make sure that your virtual
machine is actually connected to the net and that you have access to it.
I will have it in a moment, and there we go.
Let me just confirm that I have access to that,
but even if I don't I should be able to do this.
However, you won't be able to do this externally if you don't have
access to the internet.
Let's just try ping google.com, excellent, so I'm getting a reply, I am connected.
Anyway, now the we have our Kali Linux running.
In the previous tutorials we have actually managed to compromise a router.
So by utilizing that router, we're gonna effectively change it's DNS settings.
We will tell it that the DNS is actually our virtual machine.
And as
soon as this browser opens I'll show you what I mean by it.
There we go. Come on.
There we go.
192.168.1.1 and
we have already gotten the user credentials in the previous tutorials.
Here we're just going to apply them.
And there we go.
Let me just zoom it in for you.
So this is the interface of a TP-Link router, and
there are lots of settings here.
But we are interested in the DNS settings, so let me just find where they are.
You will encounter a lot of things in these routers.
You will encounter different configurations, different setups,
and sometimes it can get a bit tiring to actually find where is what.
Now, in Advanced Setup you have Firewall.
Now, if you already breached the router you can actually
disable a firewall which is fantastic.
So, even the ping of death will fly if the firewall isn't up and running.
I suspect that is true that the firewall is the only thing that
is blocking it here as far as I can see.
Now you have a lot of other things.
You have NAT.
You have routing to see who is connected.
Other things as well, we have V-LAN,
you can go into EDSL and actually figure out their credentials there as well but
we are not interested in any off those things, we are at the moment,
looking for the DNS settings, I suspect I might find it here, under internet
to get IP address, static [INAUDIBLE] gateway, not default route.
TCP encapsulation, service bridge ISP, virtual circuit.
Okay apparently it is not here.
Let's go to the next one.
It says, there we go.
So it says user, use auto discovered DNS server only.
And I do not want that to happen.
I want to use, user discovered DNS servers only to give me an option for
myself to type in whatever I want.
And I'm going to type in the IP address of my virtual machine.
You can get it by typing in ifconfig.
Excellent, there we go.
So this is the IP address.
Now these IP addresses are dynamic, and hopefully they won't change for
the duration of this tutorial.
In order to perform this attack on a larger scale, like if you want to remotely
do this, because this attack is actually meant to be done on remote basis, so
let's say that you're somewhere in Europe, and somebody else is
in eastern Russia or something like that you would be able to do this, but
you would need to have a Static from wik IP address,
not necessarily even static but, you would need to do
significant configuration to your router in order to be able to do this.
However, I recommend for the ease of use, just to get a VPN, and
I have described how to use VPNs in the previous tutorials.
So, you can go back there and figure out how to use a VPN, and
once you have a VPN static IP address, then you can actually perform this attack,
on great distances outside of local networks.
I will type in this server here.
And, once you actually type in your fake DNS server,
that you will create via the IP address of that server,
it is always a good idea to have a fallback here.
So the fallback here will be 8.8.8.8.8.
These are public Google DNS servers, you can all feel free to use them.
That's why they're there.
They're pretty good actually.
Open DNS and Google DNS servers.
Those are the two best DNS servers out there in the world as far as I know.
And people use them, as they're quite secure.
The reason why I'm putting the second method here is that you're not going to
have this server of yours running non-stop.
You want to run it for a certain period of time, get what you need.
And then you might want to turn your machine off with something like that.
And once you do that, your victim will be unable to browse the web.
You will raise suspicion.
You will raise a lot of red flags and that can be extremely problematic,
so that's definitely something that you will want to have here so
it will keep on functioning even if you're fake server is not functioning.
Click save, wait for
it, it's gotta save eventually these routers are not
state of the art and they tend to be kind of slow so keep that in mind,
don't immediately be frustrated if it doesn't work out the first time.
Just try it a couple of times.
And it should work just fine.
Let me just go ahead and clear this screen.
Now, in the next tutorial, in the follow-up tutorial,
we will actually employ some tools and see what we can do with them.
Until then, I bid you farewell and I hope to see you in the next follow-up tutorial.