Hak5 Packet Squirrel: DNS-Spoofing Demo: Difference between revisions
| Line 107: | Line 107: | ||
4. The attacker can now view the captured credentials in the SET interface. | 4. The attacker can now view the captured credentials in the SET interface. | ||
[[File:squirrelsignin.png|400px|thumb| | [[File:squirrelsignin.png|400px|thumb|left|]] | ||
== Used Hardware == | == Used Hardware == | ||
Revision as of 16:53, 18 December 2024
Summary
The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.
Requirements
- Packet Squirrel from Hak5
- target device (Laptop, virtual machine: Ubuntu)
- Network (WLAN-Router)
- Two Ethernet Cable
- One USB Cable to supply Packet Squirrel with power
Setup
- Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
- Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel
Packet Squirrel Initalization
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).
2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
- Set the network adapter to Bridge Mode.
- Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.
Verify Connection
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).
2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).
3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1 Password: hak5squirrel
Step 1: Web Server Setup
The web server hosts the cloned website that the target will be redirected to.
1. Configure the VM to be in the same subnet as the router:
- Shutdown the VM.
- In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.
- Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).
2. Install and set up the Social-Engineer Toolkit (SET):
sudo apt update sudo apt install git python3 python3-pip build- essential git clone https://github.com/trustedsec/social- engineer-toolkit.git cd social-engineer-toolkit sudo python3 setup.py sudo setoolkit
3. Configure SET to clone a website:
- Select the following options in SET:
1. Social Engineering Attacks
2. Website Attack Vectors
3. Credential Harvester Attack Method
4. Web Templates
- Enter the POST back IP address (192.168.1.16).
- Choose Google as the website to clone.
Step 2: Configure DNS Spoofing on Packet Squirrel
1. Navigate to the payload directory for switch 2:
cd payloads/switch2 nano spoofhost
2. Modify the spoofhost file to include the following entry:
www.google.com 192.168.1.16
This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).
3. Save the changes and exit.
4. Power off the Packet Squirrel by unplugging the USB cable.
5. Set the switch to Payload 2 and reconnect the power.
Step 3: Execute the Attack
1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.
2. The browser will redirect to the cloned website hosted on the web server.
3. Enter login credentials on the cloned site.
4. The attacker can now view the captured credentials in the SET interface.
