-2

DNS poisoning works only if we open a certain website. For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page.

What if we want to redirect the victim to 192.168.21.56 for anything he enters in the browser? www.example.com

He should be redirected to 192.168.21.56

Is there a possible way?

schroeder
  • 123,438
  • 55
  • 284
  • 319

2 Answers2

1

So DNS poisoning works only if we open a certain website

Not exactly, you could instead poison all hostnames in order to target all websites.

Since you tagged Ettercap, it appears you can use wildcards in the etter.dns file to achieve what you want, e.g.:

*.com       A        192.168.21.56
multithr3at3d
  • 12,355
  • 3
  • 29
  • 42
1

When a victim is accessing http://192.168.21.56/ there's no DNS queries involved, hence no DNS poisoning. DNS gives IP addresses based on hostnames, and that's already an IP address.

DNS (cache) poisoning refers to a specific attack where a resolver is tricked to cache fake records. Some resolvers will cache anything they get despite they didn't ask for it. These could be totally faked responses or smuggled as additional records within a response to an actual query.

Probably more relevant for your use case would be DNS hijacking with a fake resolver of some kind of man-in-the-middle attack, which could involve DNS spoofing or concentrate on modifying HTTP responses.

Esa Jokinen
  • 16,100
  • 5
  • 50
  • 55