Hello everybody and welcome to part three, and the final part,
of this small segment here of three tutorials for DNS Hightracking.
Anyway thus far, we have done a lot.
We have corrupted DNS settings on a remote device.
We have redirected requests to go to us.
And I still have the things running from the previous tutorial,
you can see here it's sending responses.
And I have set running but I can't actually see that.
Rather instead what we can do with set is following.
So this is where the passwords will be stored.
This is where, this is the file which will
give you the important information that you need or want to have.
And also while testing this I realized that the commercials actually do work when
you access it from a different machine.
Anyway, go ahead and
type in cd /var /www.enter/enter LS.
And there we go.
So this is the index.html.
This is the copy of the site and or is it tmp sorry.
Oh yeah. We got a lot of things here.
Anyway this collectively a copy of the site if I'm not mistaken, but
doesn't really matter.
What we are interested is particular file here so it's harvester and
there's a date, 2015, 3.
There's some location in the end doesn't matter.
What we want to do is type in tail space set -f space /,
actually we don't need a slash because we are in the directory harvester.
And press enter.
This will give us a live feed of whatever is going on.
We will notice that.
The moment you see something here.
The moment you see that you have gotten the password or stuff of a kind,
you can actually kill the DNS service that's running on your computer,
and allow the client to actually
do stuff on their own without having to go through you at all.
You won't destroy your attack if that's what you're wondering.
The moment you bring your DNS up,
your DNS settings in their router will still be first.
So the router checks the first DNS setting,
DNS servers if they're not functional it goes to a fall back.
And it will always go in that order.
So, the moment your server goes down,
it doesn't matter it's going to go to the second one.
The moment it comes up all the queries will be redirected back to you, but
you're adding an extra security layer to your attack.
Anyway let's go ahead and open up our browser.
And in the browser up here you can type in the URL which we have used for
the purposes of this tutorial.
So, just type in www.linuxquestions.org press enter and it's loading.
It didn't actually load properly here.
Let's see what the problem is.
Let's reload it, reload it again.
Okay, so I'll just try to look it up.
I've loaded this site a moment ago and I seem to have messed something up.
But that doesn't matter.
Let me just delete the history and try to do it again.
One more thing.
One more very important thing to mention is that once you do these
DNS settings on computers, stuff of a kind, your browsers may have cached files.
And your attack won't take effect until the person actually resets the browser.
If you think, oh no this is a huge setback, it's not believe me.
People turn their browsers off and on all the time.
At least once per day you will do this, at least once.
That's the minimum amount.
That's the minimum amount always.
So you don't have to worry about that that much.,
www.linuxquestions.org.
Press enter.
Let's see will it load?
No the site seems to be broken up a little bit.
Sometimes this happens.
Keep in mind that doesn't always work to the best of abilities.
It's not always perfect.
But the URL is the same.
Just check it out.
It's http://www.linuxquestions.org.
Now this doesn't really always happen, just so you know.
These files don't always get messed up like this.
But, from time to time, it does.
And, on some sites, it does, and that is the risk that you have to take.
You can check it, verify it.
But, let's just go ahead and try it in a different machine.
Let's see how well it'll load, here.
Oh come on.
I am running three virtual machines, so
this is putting a huge strain on my computer.
I am practically out of resources.
Okay, so for Linux questions,
apparently it's broke to an extent, but it still loads the site.
If this happens, as it has happened to me.
What you can do is redo the process over again.
Just the whole thing.
Just redo it.
Delete the files in /var.
Let me just show you actually what you can do.
So all of these files.
You can actually delete.
Delete the files and then repeat the cloning process with SET toolkit.
You don't have to repeat anything with a DNSChef.
Just repeat everything with SET toolkit and see if that works out.
If that works out, great.
And most likely it will.
If it doesn't, you're stuck with it.
I know of no other method that can actually help you out.
But, as I said, just try re-copying the site over again and you'll see.
A moment ago when I did this, the site has functioned fine, but
apparently now the site is not functioning fine.
And as I said before the is simply the risk that you absolutely have to take.
I mean there's no work arounds.
The best thing to do is to test it out on your virtual machine, but even if you
have to set it out on your virtual machine, things can still go wrong.
Keep that in mind.
All the testers work with that risk, and there are no guarantees.
In any case, if you have reloaded,
if you have repeated the process, which is a very good exercise for
you, you can go ahead and type in here your username.
So, I'm going to test, relax, wait.
Relax, and down here i'm gonna say, type in test.
Let's go ahead and log in.
Okay, obviously, we failed to log in, but
let's see what our file monitoring has done for us.
And you see it actually has recorded both of the logins.
You see, it says vb_login_username.
It's RELAX, cookieuser I, vb_login_password none.
The first time around but the second time around,
I've typed in RELAX and I've type in TEST.
So it does indeed work.
But let's try fixing it.
Let's try to make it work the way it was meant to work.
So remove the harvester, set toolkit.
Let's just do this really fast.
Social engineering attacks.
Website attack vectors.
A credential harvester.
Site cloner.
192.168.1.102.
Http://linux
Questions.org.
I forgot the www.
So www.linuxquestions.org.
And this what I'm doing now is really stupid because,
you should always copy paste the main name just to be certain.
But I'm the genius that's gonna go ahead and skip that, and
probably something's gonna go wrong, that's part of it.
Okay, let's exit this, and let's see what we got here.
Again, we've got a harvester file.
So tail -f harvester.
And let's go back to our WIndows machine.
Let's reload the site, and see what happens here.
Okay, it has it cached, let me just go ahead and do this.
Delete browsing history?
Yes, go ahead and remove the browsing history,
the foul browsing history that keeps tailing us wherever we might roam or go.
And here.
Www.linuxquestions.org,
please work, please!
Let's see, oops!
Okay let's see if I let's see if I can fix this okay.
Let's just open up the CMD.
Wait before I do that Kali.
I'm going to open up a real website.
Okay, I've stopped this process a moment ago.
Excellent.
So, I have paused the video to figure this out.
And I have seen what the problem is actually.
[LAUGH] It's quite stupid.
You'll see. So look.
Now the DNS proxy has stopped.
I am no longer faking the DNS requests.
Nothing is going on on my end.
Sure the harvester is still monitoring,
but nothing is going to visit that website.
This is the real linux.org, Linux.org.
Linuxquestions.org.
This is the real website at the moment and here's how I know.
Do nslookup and I'll type in linuxquestions.org.
And look at what is happening here.
It says name, linux.org and address is 75.126.162.205,
so this is actually the real website.
This is how I am rendering it on this machine.
This is not a fake website or anything like that.
At the moment for some strange reason this is how the website looks like.
Maybe there is a bug or something like that.
But this confused me a lot, and I could have edited this video and
gotten rid of all of this.
But I just figured I want to show you.
Here's why.
Not always when you do something is it your fault because it doesn't work.
Perhaps something happens on the other side.
Because our attack does work.
It works to the perfection.
It works perfectly.
It's just that the site is such as it is at the moment.
The site has been cloned to the perfection.
This is not the cloned website.
This is the original website.
Anyway, let me just conclude the tutorial here, and
I encourage you to try this method out.
Give it a shot.
You can even make a website of your own, which you can test or something like that.
You can even download a website from somewhere and
use it within your own LAN environment to do some stuff with it.
to create a testing environment for
yourself where you can safely test everything.
And you will see that sometimes it's gonna load properly,
sometimes it's gonna load improperly.
But, from time to time It will actually be the right side and
you will think that there is something wrong with it, but no.
You can easily check this up with NSlookup and
it will give you the IP address that you have requested.
And if the IP address is correct, off the original website and you know that you
are accessing the right site but perhaps there is something wrong with it.
At that particular moment usually I don't know.
It breaks or something like that but those cases are rare.
They don't happen that often, but
you should exclude that possibility immediately.
See I have to cut the recording there.
I think I spent an hour looking for the solution trying to figure out what was
wrong with it until I finally figured out that it's actually the real site.
Anyway, try it out. Try some other methods from the SET
toolkit as well.
Later on, we will do some other stuff with exploiting websites and
what you can actually do to them.
There are stuff like SQL injections which are very important.
You have also Java injections into URL's.
So if you modify the URLs, you can actually have JavaScripts run,
or something of a kind, and
you can actually obtain remote control of somebody's browser.
There are many more things that we shall do, but
for the time being, I'm gonna cut this tutorial here.
I would like to bid you all farewell, wish you a lot of luck, and until next time.