'使用Ettercap和SET进行DNS欺骗、钓鱼'

Posted on | Edited on | In

1.工具介绍

1.1Ettercap

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

1.2SET(Socail-Engineering-Toolkit)

Social Engineer Toolkit(SET)工具在一个接口囊括了许多有用的社会工程学攻击。SET的主要目的是自动化并改进社会工程学攻击。它能够自动生成隐藏了EXP的 网页或电子邮件消息，同时还能使用Metasploit的payload，例如网页一旦被打开便会连接shell。

2.工具使用

2.1Ettercap参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]

TARGET is in the format MAC/IP/IPv6/PORTs (see the man for further detail)

Sniffing and Attack options:
  -M, --mitm <METHOD:ARGS>    perform a mitm attack
  -o, --only-mitm             don't sniff, only perform the mitm attack
  -b, --broadcast             sniff packets destined to broadcast
  -B, --bridge <IFACE>        use bridged sniff (needs 2 ifaces)
  -p, --nopromisc             do not put the iface in promisc mode
  -S, --nosslmitm             do not forge SSL certificates
  -u, --unoffensive           do not forward packets
  -r, --read <file>           read data from pcapfile <file>
  -f, --pcapfilter <string>   set the pcap filter <string>
  -R, --reversed              use reversed TARGET matching
  -t, --proto <proto>         sniff only this proto (default is all)
      --certificate <file>    certificate file to use for SSL MiTM
      --private-key <file>    private key file to use for SSL MiTM

User Interface Type:
  -T, --text                  use text only GUI
       -q, --quiet                 do not display packet contents
       -s, --script <CMD>          issue these commands to the GUI
  -C, --curses                use curses GUI
  -D, --daemon                daemonize ettercap (no GUI)
  -G, --gtk                   use GTK+ GUI

Logging options:
  -w, --write <file>          write sniffed data to pcapfile <file>
  -L, --log <logfile>         log all the traffic to this <logfile>
  -l, --log-info <logfile>    log only passive infos to this <logfile>
  -m, --log-msg <logfile>     log all the messages to this <logfile>
  -c, --compress              use gzip compression on log files

Visualization options:
  -d, --dns                   resolves ip addresses into hostnames
  -V, --visual <format>       set the visualization format
  -e, --regex <regex>         visualize only packets matching this regex
  -E, --ext-headers           print extended header for every pck
  -Q, --superquiet            do not display user and password

LUA options:
      --lua-script <script1>,[<script2>,...]     comma-separted list of LUA scripts
      --lua-args n1=v1,[n2=v2,...]               comma-separated arguments to LUA script(s)

General options:
  -i, --iface <iface>         use this network interface
  -I, --liface                show all the network interfaces
  -Y, --secondary <ifaces>    list of secondary network interfaces
  -n, --netmask <netmask>     force this <netmask> on iface
  -A, --address <address>     force this local <address> on iface
  -P, --plugin <plugin>       launch this <plugin>
  -F, --filter <file>         load the filter <file> (content filter)
  -z, --silent                do not perform the initial ARP scan
  -6, --ip6scan               send ICMPv6 probes to discover IPv6 nodes on the link
  -j, --load-hosts <file>     load the hosts list from <file>
  -k, --save-hosts <file>     save the hosts list to <file>
  -W, --wifi-key <wkey>       use this key to decrypt wifi packets (wep or wpa)
  -a, --config <config>       use the alterative config file <config>

Standard options:
  -v, --version               prints the version and exit
  -h, --help                  this help screen

2.2SET

1
2
3
4
5
6
1) Social-Engineering Attacks
2) Penetration Testing (Fast-Track)
3) Third Party Modules
4) Update the Social-Engineer Toolkit
5) Update SET configuration
6) Help, Credits, and About
1
2
3
4
5
6
7
8
9
10
11
 1) Spear-Phishing Attack Vectors
 2) Website Attack Vectors
 3) Infectious Media Generator
 4) Create a Payload and Listener
 5) Mass Mailer Attack
 6) Arduino-Based Attack Vector
 7) Wireless Access Point Attack Vector
 8) QRCode Generator Attack Vector
 9) Powershell Attack Vectors
10) SMS Spoofing Attack Vector
11) Third Party Modules
1
2
3
4
5
6
7
8
1) Java Applet Attack Method
2) Metasploit Browser Exploit Method
3) Credential Harvester Attack Method
4) Tabnabbing Attack Method
5) Web Jacking Attack Method
6) Multi-Attack Web Method
7) Full Screen Attack Method
8) HTA Attack Method
1
2
3
1) Web Templates
2) Site Cloner
3) Custom Import
1
2
3
1. Java Required
2. Google
3. Twitter

3.实验过程

3.1生成钓鱼网页

生成钓鱼网页之后，使用Windows7访问，并输入账号密码进行测试，在Kali中获得输入的信息。

3.2DNS欺骗

使用Ettercap进行DNS欺骗，这里使用图形化界面，也可以直接在终端输入命令。直接输入命令可以查看参考[1]。

Step 1：Scan for Hosts，然后打开Hosts List

Step 2：Add to Target

Step 3：Mitm 选择ARP poisoning，勾选Sniff remote connection

Step 4：Plugins，选择dns_spoof

3.3钓鱼结果

在进行DNS欺骗后，使用Windows7，访问www.jj.com。
此时，页面显示的是之前的钓鱼网页。

输入账号密码进行测试。

4.原理

DNS欺骗是一种中间人攻击形式，攻击者冒充域名服务器，向主机提供错误DNS信息，当用户尝试浏览网页时，跳转到错误的攻击者的主页。再通过钓鱼网站可以获取用户的关键信息。

5.参考

[1] 技术讨论 | 利用SET和Ettercap实现内网钓鱼获取帐号密码

[2] DNS欺骗原理及其防御方案