[Day 4] 3. Assignment (DNS Spoofing)

Objective: Set up a DNS spoofing scenario within a VirtualBox environment with 4 Debian 12 (without GUI) Linux machines.

Machines to Set Up:

1. DHCP Server:

   • IP Address: 192.168.50.51
   • DHCP Range: 192.168.50.151 to 192.168.50.199
   • DNS: 192.168.50.100 (this will be the DNS server for all clients)
   • Network Adapter: Internal Adapter
     • This is set to be an internal network because the DHCP server only needs to communicate with the local network (other machines in the same internal network).

2. Phishing Web Server:

   • IP Address: 192.168.50.101
   • Network Adapter: Internal + NAT Adapter
     • Internal: Connects to the internal network so it can interact with other machines.
     • NAT: Allows the phishing web server to access external networks (e.g., the internet) if necessary for any external dependencies.

3. DNS Server:

   • IP Address: 192.168.50.100
   • Network Adapter: Internal + NAT Adapter
     • Internal: Connects to the internal network to handle DNS requests from other machines.
     • NAT: Provides a way to access external resources like the internet (e.g., if you need to resolve DNS requests for external sites).

4. Victim's Machine:

   • IP Address: Dynamic (Assigned by the DHCP Server at 192.168.50.51)
   • Network Adapter: Internal Only
     • This machine is isolated to the internal network and relies on the DHCP server to get its IP address.

Key Points to Note:

• DHCP Server: The victim's machine will get its IP dynamically from the DHCP server (192.168.50.51). This DHCP server also provides the victim's machine with the DNS server's IP (192.168.50.100), which is the key to spoofing.

• DNS Spoofing Setup: The DNS server (192.168.50.100) will resolve requests for

  Copy

  google.com

  to the phishing web server (192.168.50.101) instead of the actual Google website.

Network Adapter Types and Their Purpose:

1. Internal Adapter (Used for DHCP Server, Phishing Web Server, Victim’s Machine):

   • Ensures the machines communicate only within the isolated internal network. The DHCP server assigns IPs to clients, and the DNS server is accessible only within this network.

2. Internal + NAT Adapter (Used for Phishing Web Server and DNS Server):

   • Internal: Ensures communication with other machines in the internal network.
   • NAT: Allows access to external resources (like the internet) for resolving external DNS queries or dependencies needed for the phishing web server setup.

3. Internal Only (Used for Victim’s Machine):

   • This machine is restricted to the internal network, making it reliant on the DHCP server for its IP configuration and DNS setup.

Clarifications:

• This exercise is focused on COSA, FCN, and Infrastructure concepts (related to DHCP and DNS). It's important to have a strong understanding of these topics before proceeding.

• The phishing attack part (DNS spoofing) is secondary to the core task of setting up the network infrastructure.