DNS Spoofing : Redirect Traffic On LAN To Your Fake Website

DNS Spoofing : Redirect Traffic On LAN To Your Fake Website

wifi hacking   23:36:00

WHAT IS DNS..?

DNS which stands for Domain Name System, is a naming system for computer, services, or any other resources connected on a network or Internet. DNS mainly serves the function of mapping Domain names which can be easily memorized by humans (like facebook.com) to their ip addresses (like 173.252.120.6), which are rather difficult to remember by us. The DNS is, in fact, its own network. If a DNS doesn't know how to translate a particular Domain Name then its contacts other DNS, and so on, until the correct ip address of the domian is found.

WHAT IS DNS SPOOFING..?

DNS Spoofing (Or DNS cache poisining) is a hacking attack, in which data is introduced in DNS resolver's cache, which makes the DNS to return wrong ip address for a Domain. Hence, redirecting the traffic to hacker's computer.

OK, so enough with the geeky part. Now lets get our hands dirty.. ;)

STEP #1

Start by firing up kali and starting S.E.T ( Social Engineering Toolkit ) which comes per-installed in kali.

Open terminal window, type setoolkit and hit enter. If you are using S.E.T for the first time, you will get a disclaimer policy, enter y and press enter. 
Then, you will get a window like this :

Now, Select 1 option Social - Engineering Attacks, by giving input 1.

Then, Select 2 option Website Attack Vectors in the next step.

Then select 3 option Credential Harvester Attack Method.


And then, 2 option Site Cloner.

After, selecting the site cloner option, you'll be asked the ip address of the POST back... Enter YOUR ip Address

 To know your ip address, open a new terminal window and type ifconfig, there inet addr. will be your ip address. Look in eth0 if you are on cabled network and in wlan0 if on wireless network.

you will, then, be asked to enter the site's url. Enter the url of the site for which you want to make a fake website.

We will take facebook.com here as an example.

After entering the site's url, you will get the following message :

If it asks you to turn apache server's on reply with yes.

Now, leave this terminal window as it (Don't close it) and open a new terminal window.

STEP #2

Now let's configure ettercap before using it. Ettercap is also pre-installed in Kali.

Open a new terminal window and input :

leafpad  /etc/ettercap/etter.conf

A new window like this will open :

Change the values of selected variables in above picture from the default values to 0.

Save & exit.

Now, in the terminal window, input :

sudo chmod 777 /etc/ettercap/etter.dns

Then,

leafpad /etc/ettercap/etter.dns

Again, a text document will open before you. In this document search for the following part:

 And, edit it to :

Here we are using facebook.com, so edit it and then save and exit.

We are now done with configuring ettercap. Now let's fire it up.

STEP #3

Now fire ettercap by typing :

ettercap -G

In the terminal (Not the one in which S.E.T is open.. Don't touch it till hack is over ). After doing so gui of ettercap will pop  on the scree.

Now, follow the images :

 

 Select eth0 if on cable network and wlan0 if on wireless network.

 After clicking on hosts list, a tab with list of all the devices connected to your network will be shown to you.

In the same tab assign Target 1 to your router's ip & Target 2 to your victim's ip.

Then, go to Plugins -> Manage The plugins.

In the tab that opens now, enable dns_spoof :

Then,

As soon as we click on Start Sniffing, our attack has been initiated. Now we have to wait until our victim visits facebook.com.

As soon as our victim visits facebook.com ettercap will notify us.. :

The credentials which the victim will enter on the facebook login page will be stored in a text file the path of which is given in the terminal in which S.E.T is running... :

Go to the given path , open the file and KABOOOOM ... ::

Your victim is Done with his account .. XD

Feel free to clear your queries in the comments.

Phishing : For Dummies XD

Phishing : For Dummies XD

website hacking   18:44:00

Today, I'm going to show you how a saavy Social Engineer would trick a friend into unknowingly surrendering their Facebook password. My intent is to warn and demonstrate how easy it is to succumb to phishing via Social Engineering, and therefore expose yourself.

What is Phishing?

Phishing is the act of tricking someone into signing onto a fake website, which mimics a real site, such as Facebook. The phishing page will log the credentials that the user enters in the password field, and usually goes unnoticed with the right circumstances and some Social Engineering.

The phishing page is created by visiting the website you want to mock, copying the source HTML code, and then altering it to use a custom PHP script to log the victim's credentials. A good phishing page will seamlessly use cookies to bypass redirect filters. So if a cookie for the site exists, the user will be logged in and more than likely won't realize what happened.

Warnings

• Phishing is illegal.
• Only phish your friends who give you consent to do so.

Step 1 Get a Web Host

You need a place to host your phishing page. I like T35—they are free, and offer cPanel hosting.

1. Make a free account on T35.
2. Go to your email that you used and click the link confirming the account.

Step 2 Create the Phishing Page

Now we need to create the site that will log the victim's credentials.

1. Open up a text document using notepad, or your choice in text editors.
2. Go to the Facebook login page.
3. Right-click somewhere on the page, and click View page source.
4. Copy all of the contents of the source code and paste them into your text document.
5. Hit ctrl + f, and search for "action=" and change the method to "GET", and the text to the right of"action=" to "log.php".
6. Click File > Save as and save it with the name "index.php" (make sure to click the drop-down menu to select "all files" if it's not selected already).
7. Make a new text file, and paste this as the contents (paste the raw text, not the numbered). This is the file written in PHP that logs the victim's login details.
8. Save the file as "log.php". Again, make sure "all files" is selected in the file type drop-down menu.
9. Log in to your T35 account and click Upload. Upload both files to the root of your website (not in a folder).
10. When credentials are logged, they will be in a file called "passwords.txt" in the root of your website. Check the box next to the "passwords.txt" file when you get some logs, and click chmod. Change the file to 466 permissions, so other people can't read the victim's passwords.

Step 3 Perform the Phish

In a status update on Facebook, post something like the following:

    "Check out this funny picture of me on my website xD <post link to phishing page here>."

It's really that simple. You should start to see people's login credentials getting stored in your "passwords.txt" file. Simply because it comes from a "trusted" Facebook friend, they will go with their instincts and click the link without thinking twice about it. The best part about that PHP code posted above, is the header sends you back to the Facebook homepage, bypassing the redirect filter warning that Facebook has implemented, which will make it nearly seamless to the user who fell for it.