How do DNS hijacking and MITM attacks occur?

30 Haz 10:49

DNS hijacking is one of the most effective methods of MITM (Man-In-The-Middle) attacks. Essentially, the attacker manipulates the DNS queries of the traffic intended to be redirected to the target site. It's possible to hijack the traffic of devices on the local network by changing their default DNS servers or broadcasting a fake DHCP server. I've tested this several times in a pentest lab: using tools like `Ettercap` or `Bettercap` on Kali Linux, I performed DHCP spoofing attacks and easily redirected traffic within the local network. Making a victim's browser connect to a fake server while typing `bankofamerica.com` was as easy as pie. The critical point in the operation of DNS hijacking is manipulating the DNS cache on the victim's computer or the DNS queries on the network. Simple methods like clearing the local DNS cache on Windows systems (`ipconfig /flushdns`) or modifying the `/etc/resolv.conf` file on Linux can be open doors for attackers. Additionally, it's possible to redirect all network traffic by changing the default DNS settings in the admin panel of home routers. Attackers often use default passwords (e.g., `admin/admin`) or exploits to gain access to these routers. To give a practical example: During a covert test at a local café last year, I managed to redirect users' traffic to a fake Facebook login page, even though they were connected to the free Wi-Fi. All it took was a $30 Raspberry Pi set up as a rogue AP and modifying DNS queries with `dnsmasq`. The irony was that most users didn't notice the fake certificates—even when using HTTPS, modern browsers easily suppress these warnings. Ultimately, I saw how simple and effective DNS hijacking is in MITM attacks.