DNS Cache Poisoning and Spoofing

DNS cache poisoning manipulates a resolver into caching a forged response. Subsequent queries from network clients for the spoofed domain will be directed to your infrastructure. On local networks, this is often achieved by racing the legitimate resolver or performing Man-in-the-Middle (MitM) spoofing.

Local Network DNS Spoofing

When positioned on the same subnet as the target clients, use bettercap to intercept DNS requests and reply with forged A records before the legitimate DNS server responds.

Create a spoofing configuration file mapping the target domains to your listener.

Launch bettercap specifying the network interface, enabling the DNS spoofing module, and loading your configuration.

Clients querying any subdomain of target-domain.com will receive $LHOST as the authoritative answer. Start an HTTP or SMB listener on $LHOST to capture the misdirected traffic, relay authentication attempts, or serve malicious payloads.

Validating the Poisoned Cache

From a compromised host or a separate machine on the target subnet, issue a query for the spoofed domain to confirm the resolver or local cache is poisoned.