Fake AP + DNS Spoof

[SpMidas]

Hi, this is my first post.

I have been playing around with Fake AP + DNSSpoofing trying to learn how it works. But i'm having a problem.

I start the Fake AP, unencrypted and started dhcpd3 server. Clients can connect fine, the i run

dnsspoof -i at0

, all works fine and clients are redirect to local apache server.


At this point clients can't browse the internet because no ip tables have been set.

so when i set ip tables like this:

iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE

Clients can navigate internet through eth0 , dnsspoof prints dns requests but they are no longer redirected.


I can't figure out what is happening.

My configuration is BT 5 64. Intel wifi (wlan0) Wired interface connected to the net. (eth0).

Thanks

[VulpiArgenti]

I don't think you can have it both ways with this simple set-up. You can't spoof everything to your apache server, and forward them to the internet; it's one or the other. You could try selective dnsspoofing, or more complex iptables rules (read PwnSTAR script for some ideas).

[SpMidas]

Hi,
thanks for your reply.

I know that i cannot spoof and redirect at same time.

The problem is that when i set the packet forward (ip tables and "echo 1 > /proc/sys/net/ipv4/ip_forward" to reach internet no more dns request are spoofed but dnsspoof still printing out that the request has been spoofed.

Then i stop packet forwarding, and all dns request are spoofed again.

I dont know why is happening.