Dnsspoof

[Whistle Master]

Hi !

Petertfm suggested to make a module for DNSSpoof to be able to keep logs history, etc.

So, here it is You should be able to find it in your pineapple bar very soon

Edited August 7, 2012 by Whistle Master

[WatskeBart]

Marvelous :)

[Darren Kitchen]

Very nice indeed.

[telot]

Can you change your name to Module Master? Whistle Master is good and all, but Module Master is a much more apt description!

Can't wait to see it at the bar! Thanks WM

telot

[Whistle Master]

First version is out ;) Big thanks to Petertfm for the testing :D

[NullNull]

http://forums.hak5.org/index.php?/topic/28005-suggestionnetwork-connection-status-indicator/

I think this is a necessary feature ;)

[Whistle Master]

http://forums.hak5.o...atus-indicator/

I think this is a necessary feature ;)

Indeed ;) I added that feature into the last version.

Edited December 15, 2012 by Whistle Master

[Whistle Master]

Last version with new feature is out :)

[--nick--]

Last version with new feature is out :)

it is? oh nice.

[Boba Fett]

For what it´s the fake captive portal files?

[Boba Fett]

I got a problem sometimes, if I make dnsspoof, when the victim use https enstead http, doesnt make the redirection, this is normal?

[kurtm]

Last version with new feature is out :)

cannot access page..

what is captive portal files?

Edited February 21, 2013 by kurtm

[Whistle Master]

Captive portal files are used to "fake" the OS when connecting to the pineapple, thinking that the client is actually connected to the internet (e.g. for Windows 7 here)

[NullNull]

Captive portal files are used to "fake" the OS when connecting to the pineapple, thinking that the client is actually connected to the internet (e.g. for Windows 7 here)

Only the one for windows works (nsci.txt). The one for apples devices is not. The success.html file must be in /www/library/test/success.html in order to work. Like in petertfm's scrpit. :)

[Whistle Master]

Only the one for windows works (nsci.txt). The one for apples devices is not. The success.html file must be in /www/library/test/success.html in order to work. Like in petertfm's scrpit. :)

thanks for the report ! I fixed it in the new version :)

[Whistle Master]

Fake files feature is fixed in new version ;)

[thesugarat]

I was hoping someone could help me out with a few things.... #1 if the redirect.php file is such an important one to update why isn't there a section for it in the dnsspoof infusion?

Also, can someone explain the new redirect.php coding? I've looked at the old documents out there on github etc but they all talk about the old way i.e.

"if (strpos($ref,<domain>") { header('Location: <targetpage>.html'); }"

The new info in the redirect.php is a bit more complex and I'm not quite certain what to do... There are several things I'd like to try doing but now after looking into dnsspoof they seem to be redirecting and not spoofing... If I could simply put a line in the spoof hosts that said "www.myspace.com www.facebook.com" which meant that anyone looking to go to facebook would be sent to myspace it would be nice but I know now that won't work. So how would I go about doing that?

Also, if I wanted to drive all traffic, i.e. all requested pages, to one specific webpage located on the internet, how would I do that?

Thanks!

[Whistle Master]

To answer your first question: I will add the feature to edit the redirect.php in the infusion ;)

[thesugarat]

Thanks Whistle Master... I appreciate the addition. I don't know how often anyone else make edits to it but it seems like something people would use.

[NullNull]

i was playing with my pineapple (fw 3.0) after a long time and i was having some problems with the autostart feature. After some digging it turns out there is a wrong filepath at /pineapple/components/infusions/dnsspoof/includes/autostart.sh

Original:

dnsspoof -i br-lan -f /pineapple/config/spoofhost > /dev/null 2> ${MYPATH}log/output_${MYTIME}.log &

Correct:

dnsspoof -i br-lan -f /etc/pineapple/spoofhost > /dev/null 2 > ${MYPATH}log/output_${MYTIME}.log &

It's very wierd that no one noticed after such a long time!

Is 1.1 the latest version? :/

Edited December 27, 2013 by KiatoGS

[NullNull]

Until iOS 6 Apple's devices were just looking at .../library/test/success.html to check internet connection. Creating the same html file at /www/library/test/ it was easy to fool the device that it have internet connection BUT since iOS 7 is out this will not do the trick. iDevices are now cheking for internet connection using a list that contains over 200 servers. Here is a link with the solution for devices using lighttpd.

http://forum.daviddarts.com/read.php?9,8879,8910#msg-8910

Pineapple is using uhttpd. Mayde whistlemaster can do some of his magic ;).

[Sebkinne]

That's something we can easily build I to the firmware. Could you make this suggestion in our bug tracker and Mark it as a suggestion?

Best regards,

Sebkinne

[NullNull]

I dont think that it has to be part of the firmware because people that are using a captive protal DO want that pseudo-browser to pop-up.

I posted it here because dnsspoof infusion already has an option of installing " Fake captive portal files " (for iOS and Windows)