Hello everybody, and welcome to this tutorial.
Today I am going to go ahead and start
using the tools which I have previously mentioned, dnschef and Set toolkit.
Now Set Toolkit, well it's actually called Set, but
here you're gonna invoke it with a command Set Toolkit.
Anyway, We're going to use it to clone a website.
And we're going to use dnschef to redirect all requests to that website,
from the machines which answer to our DNS servers to a particular IP address.
Now if this sounds a bit complex, or if you didn't understand exactly what I said.
Bear with me for
a moment here, and soon you will realize very fast what I meant by it.
So let's just go ahead and bring up this dnschef command here,
you can do this manually as well.
You can actually configure a DNS server to run locally.
And to conduct host name to IP address resolutions.
But that's a bit complex, and there's a lot of configuration involved.
It's a lot simpler to just use the dnschef tool kit.
And here you have these arguments, which I've mentioned just now.
Where a domain name gets resolved to an IP address.
So basically give any IP address that you want here.
Basically that will be of your own web server.
So your own IP address within LAN.
And here you have a fake domains.
So you give a name of a real domain, and specify an interface.
Now here's what I mean by this.
Here where it says fakeip, this can be your IP within LAN on which
your Apache server is running, your web server.
Or you can give it your public IP address.
So if give it your public IP address,
you're going to need to do some configuration on your router.
In order to let traffic pass to your web server.
However, this is not really advisable.
Rather, instead, what is far better is to have a VPN.
I have showed you in the previous tutorials how you can use, and
configure with VPN services.
Quite simple, actually.
Nothing much to it.
It's in your Network Manager.
You just add a VPN of a different kind, and that's it.
You need PPTP VPN with a static IP address.
Think it's gonna cost you about ten bucks a month, something like that,
if you wanna run it.
If you want to do this attack over outside of your LAN network, but within LAN,
we're gonna use some local IP addresses.
Now key thing to note, there is no difference here literally.
Between an attack within your own network, or outside of your own network.
The only difference is the IP addresses that are used.
And the second thing,
this will pretty much work with every single website out there.
However there are some caching problems with browsers.
So that can present some difficulties here.
But we'll see how we'll see how it goes.
First of all we've infected a router with our own DNS.
We've changed the DNS settings there.
And now we're gonna run dnschef.
Now the interface specification is simply the interface you are using.
If you're not sure which interface you are using, you can check that with if config.
Which I have showed you in the previous tutorials.
Or you can actually type in all zeros.
So, instead of 192 you can type in a 0.
Instead of 168, a 0.
Instead of 1, a 0.
And instead of 102 a 0 as well.
Yeah, this should work as far as I see.
But as the tutorial progresses, I'll see how it goes.
I did give it a shot a couple of times before this tutorial and
I had some problems.
Hopefully, you will not encounter the same.
I've had some problems due to the configuration that I am running
in the background.
But I had to change a lot of things.
But none of those things, you won't need to do any of those things.
Primarily, because you're going to be using your home computer where you don't
have these crazy things that I have here as well.
Anyway enough of that nonsense.
I'm just going to go ahead and run this.
And in case you didn't figure out what these IP addresses are,
let me just type in ifconfig, and there you go.
Eth0 that's the interface that I used to connect to the internet.
And that's the LAN IP address that I have been assigned.
192.168.1.102. That is the same IP address with which we
have typed into our router to be our designated DNS server.
But this is randomname.com.
Okay, that's not gonna work, probably, because randomname.com.
Okay, it might exist, but I honestly don't know.
So let's just go over and pick one website.
We're not really gonna do anything to a website, so it doesn't really matter.
My favorite forum, Linux Questions.
This is definitely the place to be.
The amount of answers that people give here is amazing.
And I don't think anybody's going to every going to try to hack your user name and
password for this forum.
Primarily because there is no point.
There are no finances here or anything of this kind.
This is just people helping one another out.
We're just going to go ahead and copy this.
Minimize the browser, reinvoke our command.
Where it says fake domain.
Got to delete this, paste linuxquestions.org.
Go ahead and press enter.
And that's gonna resolve all requests on our DNS servers from that.
All the requests that have the linuxquestions.org will inevitably be
resolved to this IP address here, which is our own website server.
But that's not gonna do us much good, if we don't have a web server that's running.
So let's just take of that shall we?
Clear the screen.
Do I have anything of importance here?
No I do not.
Now we need to do a set tool kit.
setoolkit.
Keynote there is no double t here.
So set and then double o.
Press Enter, and this tool is extremely easy to use.
I mean, there isn't really much to it.
It's very powerful, but it's very simple.
I have no idea how they achieved to do this, but apparently they have.
Anyway, you have a great deal of options here which you can use.
I would definitely advise that you try some of them out.
Definitely type in 6 for help, see what's there.
Just read a little bit through it.
I mean, you're probably not gonna try all of them out, but
I would definitely advise that you pick a couple, or at least one.
Other than the one that we're going to use today, and see how it works.
All of these things have their own submenus.
So let's go into Social-Engineering Attacks.
See, there is like, Spear-Phishing Attack Vectors,
Website Attack Vectors, Infectious Media Generator, Create a Payload,
Mass Mailer, except there are lots of things here.
You can conclude what they are for a lot of them just by reading the names.
But I would definitely advise you to read a bit more.
And to just try, try ,try some of these things because there's so
many options here.
There's so many vectors of attack.
It's ridiculous.
It's something,
something is bound to work on the site that you want to do something on.
Something's bound to work.
Not only setoolkit, but you have so many tools here in Kali Linux, and on the net.
So many options, something's bound to work, so don't worry about it.
Anyway, what we need is Website Attack Vectors.
Because we're gonna be doing that.
And again, we have sub menus, a lot of them.
Let's go with Credential Harvester Attack Method.
Because we want to take some credentials.
So press three, and now we want a Site Cloner.
So we want to clone the site, and have it stored on our local web server.
This is web templates.
You can have a web template that is standing by somewhere.
You can clone a site or you can custom import.
Anyway, press two.
IP address, so I need the IP address.
And in order to get the IP address I'm afraid I'm gonna need to use a ping.
But just zoom in
a little bit nslookup
linuxquestions.org.
Amazing, amazing, nslookup.
Okay, so this is the domain and this is the IP address.
We'll just do this instead.
You can also check it like this, it's a lot simpler.
Just type in ping.
And there we go.
Same IP address just a different method I suppose I'd want to choose something else.
So IP address but we don't actually have the IP address here.
Sorry this is my mistake.
This option is used for what the server in the post do.
So sorry. This is my bad.
You need to type in 192.168.1.102.
Basically this your IP address.
And for the post back in Harvester/Tabnabbing.
If you are, yep.
Here we go.
So, it also says if you are using external IP address,
use your external IP address for this.
But we are obviously not going to use our external IP addresses.
Not today, but of course you can if you have a VPN.
Press ENTER here and now we need a domain name.
The full thing with HTTP and WWW.
Easiest way is just to go ahead and
CTRL+C, and then paste it back in here, and there you go.
Notice that the protocol is HTTP, but this works with HTTPS as well.
There's literally no difference,
just type in HTTPS and it's gonna clone it no problem.
So you can see here, in the title it says SET supports both HTTP and HTTPS.
You don't have to worry about it.
It says right here in the title.
And I have tried it out with some HTTPS sites.
It does indeed work, no problems at all.
Okay, so let's go.
It's cloning it.
This could take a little bit of time.
And there are a lot of tutorials out there on the net.
They basically say that you should wait, and stay here.
But apparently with newer versions of SET, you can't.
So just go ahead and press Enter, 99 to exit, 99 to return.
Exit Social- Engineering toolkit.
Clear the screen, and now we have our website cloned.
Let me just show that to you.
So this is LinuxQuestions.org,
and if I type in 192.168.1.102.
You see, there we go.
This our IP address, and the website is pretty much the same.
Okay, the zoom is different, but I suppose I can zoom it in.
No problems there.
Maybe, the site that we have copied is
even better because there are no ads on it.
That's fantastic.
We didn't copy the ad as well.
And this site that we have copied it to, the clone,
actually contains a JavaScript in.
Which we'll harvest the credentials if I'm not mistaken.
How we will do that I will show you in the follow up tutorial.
Where we will actually be extracting the credentials,
and saving them to our files on our computer.
Now this sort of attack is very important.
Primarily because some of the previous attacks which I've showed you,
they're specific attacks.
And this one is a general attack.
This will work on pretty much anything out there.
And it can be used in combination with SSL Strip as well.
So imagine if you can use SSL Strip remotely somewhere
to to the strip the requests for encrypted sites.
But SSL Strip doesn't always work, so that's kind of a tricky Thing to do.
Anyway, I'm gonna leave everything running like it is.
And I bid you farewell.
And I hope to see you in the next tutorial.