Phishing vs DNS Poisoning / Spoofing

Today I am going to explain about another cool experiment done by me. That is a DNS Poisoning (or Spoofing) attack. So let's start,

Before the start I like to compare the Phishing attack and the DNS Poisoning attack. As we know Phishing is a well known method armed with Social Engineering to steal sensitive information by using bait (Compromised URL or Link). In the DNS Poisoning, the process is likely same, but not exactly the same.

When we are talking about Phishing web pages there is a main weak point, Phishing web pages can not serve under genuine domain addresses, (There are methods by using Cross-site Scripting but I am not going to talk about that.) but when talking about DNS Poisoning, hackers can serve malicious web pages under genuine domain addresses. So that is very hard to identify these kind of attacks.

Image Reference: https://www.imperva.com/learn/application-security/dns-spoofing/

Now I am going to talk about how to perform these kind of attacks. To success this process, the hacker needs to accomplish several things.

1. First thing is hacker need to host a common phishing like a malicious web page to save a login credentials (or any other sensitive information)
2. After that, the hacker need to do something (by using malware or compromised local DNS Server) to modify DNS records in victim end. So he can point the targeted genuine domain address of the malicious web page.

So how this is working, when the victim tries to access the targeted web site, the domain name must resolve to the appropriate web server, but with that modified DNS records now this domain name address is resolving to the hacker's malicious web page. So victim haven't any idea about what is going on the back side because even domain name address is correct.

The worst case is even self signed SSL Certificates could use for this kind of attacks. If that so probably SSL Certificate errors should pop up in the web browser but with Social Engineering methods hackers able to get rid of that.

Now I think you have some idea about this method. At last I want to say I was doing this in my own local area network, which is I had full permission to do anything I want, but don't try to do this in any unauthorized networks or to do harm anyone.