#615·bettercap

DNS.spoof not working as expected

Author: ZeroDahlCreated Aug 28, 2019Updated Aug 6, 2025

Prerequisites

Please, before creating this issue make sure that you read the README, that you are running the latest stable version and that you already searched other issues to see if your problem or request was already reported.

! PLEASE REMOVE THIS PART AND LEAVE ONLY THE FOLLOWING SECTIONS IN YOUR REPORT !

Bettercap DNS.spoof does not send the the victim to the apache server/Kali IP on eth0 192.168.0.71

BetterCap Version latest stable 2.24.1

Kali / Attacker - 192.168.0.71 Victim - 192.168.0.60

Steps to reproduce set dns.spoof.hosts hosts.conf dns.spoof on

192.168.0.0/24 > 192.168.0.71 » dns.spoof on 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.sabay.com.kh -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof loading hosts from file hosts.conf ... 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.yahoo.com -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.outlook.com -> 192.168.0.71 192.168.0.0/24 > 192.168.0.71 » [15:54:41] [sys.log] [inf] dns.spoof *.typing.com -> 192.168.0.71

set arp.spoof.targets 192.168.0.60

192.168.0.0/24 > 192.168.0.71 » arp.spoof on 192.168.0.0/24 > 192.168.0.71 » [15:35:58] [sys.log] [inf] arp.spoof arp spoofer started, probing 1 targets. 192.168.0.0/24 > 192.168.0.71 »

host.conf file 192.168.0.71 *.yahoo.com 192.168.0.71 *.typing.com 192.168.0.71 *.outlook.com

Sys.log when going on victim PC 192.168.0.0/24 > 192.168.0.71 » [15:55:29] [sys.log] [inf] dns.spoof sending spoofed DNS reply for www.typing.com (->192.168.0.71) to 192.168.0.60 : 2c:fd:a1:5a:17:dc (ASUSTek COMPUTER INC.) - DESKTOP-QAE0QVC 192.168.0.0/24 > 192.168.0.71 » [15:56:28] [sys.log] [inf] dns.spoof sending spoofed DNS reply for www.outlook.com (->192.168.0.71) to 192.168.0.60 : 2c:fd:a1:5a:17:dc (ASUSTek COMPUTER INC.) - DESKTOP-QAE0QVC

Victim PC either 'site can't be reached' or original site requested will appear after some time, ie outlook.com will load after a minute or so.

arp.ban completely kills the victim pc.

expected result; server page appears.

Environment

Please provide:

  • Bettercap version you are using ( bettercap -version ).
  • OS version and architecture you are using.
  • Go version if building from sources.
  • Command line arguments you are using.
  • Caplet code you are using or the interactive session commands.
  • Full debug output while reproducing the issue ( bettercap -debug ... ).

Steps to Reproduce

  1. First Step
  2. Second Step
  3. and so on...

Expected behavior: What you expected to happen

Actual behavior: What actually happened

--

♥ ANY INCOMPLETE REPORT WILL BE CLOSED RIGHT AWAY ♥