# DNS Cache Poisoning and Spoofing

- **URL:** https://hackindex.io/services/dns/exploitation/dns-cache-poisoning-and-spoofing
- **Path:** DNS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/dns/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-11

DNS cache poisoning manipulates a resolver into caching a forged response. The resolver then serves that forged answer to every client that queries it, for the duration of the TTL. Subsequent queries hit your infrastructure instead of the real server. On local networks, the attack works by racing the legitimate resolver. You need a position on the same subnet or an ARP-level MitM to intercept and answer queries first.

- **bettercap DNS spoofing** intercept queries on the local subnet and inject forged A records before the legitimate server responds.
- **Wildcard pattern matching** spoof all subdomains of a target domain to your listener with a single regex rule.
- **ARP spoofing prerequisite** without ARP poisoning, bettercap only intercepts queries directed at your own machine.
- **Cache validation** query the resolver from a test host to confirm the poisoned entry is being served.
- **DNSSEC limitation** validating resolvers reject forged responses with SERVFAIL, but most internal resolvers do not enforce it.

## Local Network DNS Spoofing

When positioned on the same subnet as the target clients, use `bettercap` to intercept DNS requests. It replies with forged A records before the legitimate DNS server responds. Bettercap acts as a transparent UDP port 53 proxy. It matches each query name against your ruleset and injects a spoofed response with your IP as the answer.

The wildcard pattern `.*\.target-domain\.com` matches any subdomain. Requests for `mail.target-domain.com` or `vpn.target-domain.com` all resolve to your listener. Create a spoofing configuration file mapping the target domains to your listener.

```
# spoof.txt
.*\.target-domain\.com $LHOST
```

Launch `bettercap` specifying the network interface, enabling the DNS spoofing module, and loading your configuration. Bettercap requires root. Without ARP poisoning active, bettercap only intercepts DNS queries directed at your own machine. To capture all subnet traffic, also enable the ARP spoofing module with `arp.spoof on`. Watch the bettercap console for `dns.spoof` log lines confirming each forged reply is sent.

```bash
bettercap -iface eth0 -eval "set dns.spoof.hosts spoof.txt; dns.spoof on"
```

Clients querying any subdomain of `target-domain.com` will receive `$LHOST` as the authoritative answer. Start an HTTP or SMB listener on `$LHOST` to capture the misdirected traffic, relay authentication attempts, or serve malicious payloads. NTLM hashes arrive immediately when a client authenticates against a spoofed SMB share. Relay those hashes with `impacket-ntlmrelayx` targeting other hosts in scope.

## Validating the Poisoned Cache

Issue a query for the spoofed domain from a compromised host or a test machine on the subnet. This confirms whether the resolver or local cache is poisoned. The output should return your IP. If it returns the real IP instead, bettercap is not intercepting traffic from that host. Check ARP tables on the target to confirm your MAC is in the ARP cache for the gateway.

DNSSEC-enabled resolvers reject forged responses with a SERVFAIL. Most internal corporate resolvers do not enforce DNSSEC, but check if the resolver is configured to validate. If poisoning does not hold, the client may query a different resolver than the one bettercap intercepts. Clients with a hard-coded DNS server IP bypass any resolver you have poisoned. Target the specific resolver the client uses, or intercept at the network layer directly.

```bash
dig @$TARGET_IP internal.target-domain.com A +short
# 192.168.1.50
```