I've noticed that most current browsers use the search engine when you enter an address in the addressbar.
When I start DNS spoof and ping the address (on the client) it returns the correct (spoofed) IP.
When I start a browser and enter the address (on the client) in the addressbar it uses the engine and goes directly to the original page.
To check if the DNS spoof is working correctly:
- Start the DNS spoof.
- Connect the client to the pineapple.
- Flush the DNS on the client. (just to be sure)
- Ping the spoofed address on the client. (don't use a browser)
Does it return the correct IP you've chosen in the DNS spoof?