mk34dnsspoofguide

DNS Spoofing Guide

The WiFi Pineapple makes DNS Spoofing, and thus phishing, simple. Similar to the auto-rickroll attack of the Mark II, the Mark III comes with the ability to spoof DNS entries as well as serve up PHP pages.

In this guide we'll walk through the process of setting up a phishing site to pose as example.com

From the WiFi Pineapple's Status page click Edit next to DNS Spoof. In the configuration text area add 172.16.42.1 example.com on a new line and click update.

Now using SSH or SCP edit Pineapple's /www/redirect.php file to look similar to the following:

<?php
$ref = $_SERVER['HTTP_REFERER'];
if (strpos($ref, “example”)){ header('Location: example.html'); }
require('default.html');
?>

The above redirect.php script checks the referrer for the word example. If example is found in the URL it forwards the browser to the example.html page.

Now create a file containing the text “Hello World” and save it as example.html. Upload it to the Pineapple's /www/ and start the DNS Spoof service from the Status page.

From a client connected to the WiFi Pineapple browse to example.com and notice your own “Hello World” text.