It is possible for an attacker controlled DNS server that supports wildcards, such as bind, to force all domains to resolve to the attacker’s web server. The web server can then proxy the real hostname and inject data into the stream, or load phishing pages for specific sites (sites which don’t allow proxies perhaps?), or launch malware, etc.

This way user HTTP requests can easily be logged and a simple script on the web server could immediately change the payload without having to worry about DNS lease length.

http://www.dnspython.org/

thanks for the comments everyone

@Adrian:
I was thinking about creating a more complex script which can also redirect different entered urls to different IP’s/vHost’s and let any that are not listed in this “host” file go to the correct location but this script is just a PoC.

I could have Wifitap work on a WDS link as well, with an ugly hack I’m not really proud of.

Getting back to the script, this attack is very like airpwn. This tool, demonstrated at Defcon 2004, catches HTTP requests for pictures and injects arbitrary replies. Very handy when you have… Let’s say… A JPEG or PNG buffer overflow on browser :) You can also reply “GET /” requests with a 301 or 302 that will redirect browser anywhere you want, like a metasploit loaded with whatever client side exploit you may like.

Check http://sid.rstack.org/pres/060.....reless.pdf slides 33 to 47.

You make it sounds like Gnucitizen is similar to Alcoholics Anonymous for blackhats. Also, by grouping blackhat and script-kiddie together, you make it sound like they are related to another, when, in fact, they are not. Could you give me some good reasoning on that?

wifiping.py is just a PoC that answers ping requests on the fly
wifiarp.py that poisons ARP requests on the fly
wifidns.py that roughly does the same as yours

Everything based on Scapy.

It’d also be useful to write a variation of the tool that only makes certain domain names resolve to the evil IP address, and simply query a public DNS server for all other IPs. For instance, maybe the attacker is only interested in poisoning http://www.trustedbank.foo and wants all other domain names to resolve to legitimate IP addresses.