Dr. Erdal Ozkaya
Search
  • Home
  • About Me
  • Home
  • About Me
  • Home
  • How to ...?
  • Local DNS Hacking ( 0nly for fun – Free Guide)

Local DNS Hacking ( 0nly for fun – Free Guide)

Erdal2021-09-13T16:45:15-04:00

Local DNS Hacking

Fun: Force your End Users to use “your site” (local DNS “hacking”)

OK OK, this is not real hacking but it’s fun 🙂 As well as there are some attack types, where the browser is been hijacked so the User can’t go to some specific web pages or the user will be forced to open that page as soon as they use they Internet browser, where the user will be directed to the FAKE/ phishing web page or malware loaded local site)

By default, when a Windows PC User tries to open a website from a browser, Windows will try to resolve the website name to its IP address from the local DNS cache.

The local cache is stored :

C:\Windows\System32\drivers\etc\hosts

If this fails, it will query the host file and if there is no entry to the website there , then it will contact the DNS server which is set up in your NIC (Network Card) .

If there is any entry in the local cache , the PC will load or block that site depending on your settings. To make sure there is nothing in the DNS cache, you have to clear it so the little fun trick can work on your “victim” user or if you can :

open CMD and type “ipconfig /flushdns” or restart the DNS service from the services tab.

Open the file via typing “C:\Windows\System32\drivers\etc\hosts” in to the search area in your start menu

This will open the HOST File for you ( it will ask you, how you want to open the file type, select via NOTEPAD) , which is inside the “etc” section of your drivers

add an entry as below:

127.0.0.1 domainname.com

(domainname.com being the website you want to block. Save the hosts file outside the etc folder and then move it there, replacing the older version, as Windows won’t let you save the file there directly. Also make sure there’s no extension like .txt at the end of the file name)

This way whenever a user tries to go to anything.domainname.com, their browser redirects them to 127.0.0.1 which is the local host. Or maybe you can redirect them to an HTML page stating the reason why that page is blocked from within your organization.

PS: It’s always a good practice to “copy the original” HOST file, so when the FUN is over, everything can be loaded to its original state.

Enjoy 🙂

More How to blogs 

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


Related Posts

Attack Surface Reduction

Applying Attack Surface Reduction – 1

Applying Attack Surface Reduction First some definitions/terminologies so that we all know what we are talking about Threat Actor: A threat actor... read more

6 Strategies that security leaders must take to safeguard data

Six Strategies that security leaders must take to safeguard data in storage and backup systems The what, why, and how of... read more
Net Stat for Security professionals

Netstat for Security Professionals -2021

Netstat for Security Professionals This article was originally posted in 2012, right after my Microsoft TechEd New Zealand session, Updates on... read more
Does Apple spy on iPhone ?

Apple and Privacy

Apple and Privacy Does really Apple cares about your privacy, as they advertise heavily or is this what they want us... read more
Zombies in Social Networks Erdal Ozkaya

Zombies in Social Networks – watch 4 Free

Zombies in Social Networks We have arrived in a time where social networks have become an essential part of our lives.... read more
mark simos

Mark Simos Resource List – Absolutely 4 Free

Mark Simos , a Chief Security Advisor at Microsoft and a great friend of mine recently shared a very useful... read more
Network Security

DIFFERENCES BETWEEN EDR AND SIEM?

DIFFERENCES BETWEEN EDR AND SIEM? Nowadays, cybercriminals use sophisticated and complex strategies to infiltrate a network. That is the reason why... read more

Don’t let Hackers steal your password 2

It’s not a secret anymore, Hackers know our passwords.  551,509,767 real-world passwords previously exposed in data breaches. Are you one... read more
VMware error

VMware error ” Unable to open kernel device “\\.\VMCIDev\VMX ” – S1mple & Effective

VMware error " Unable to open kernel device "\\.\VMCIDev\VMX "   Are you getting the bellow error and don't know how to... read more

Local DNS Hacking : Force your End Users to use “your site” Laugh at mates 1

Local DNS Hacking Force your End Users to use “your site” OK OK, this is not real hacking but it’s fun :) As well... read more

Categories

  • About Dr Erdal Ozkaya (298)
    • Awards (96)
    • Erdal in the news (118)
    • Feedback (90)
    • My Books (54)
    • Who is Dr Erdal Ozkaya ? (2)
  • Announcemets (302)
  • Artificial Intelligence AI (10)
  • Certification (52)
  • Cloud Computing (72)
  • Cybersecurity (322)
  • Cybersecurity Leadership (52)
  • Financial Sector (31)
  • Forensics (17)
  • Free Events (156)
  • General (133)
  • How to …? (63)
  • ISO 2700x (12)
  • News (38)
  • Reviews (77)
    • Book Reviews (33)
    • Free E-Books (13)
    • Hardware Review (9)
    • Security Review / Reports (10)
    • Software Review (8)
  • Video Tutorials (101)
  • What is new? (27)
  • Windows (30)

Recent Comments

  • Erdal on Free EDR Certification Training
  • SANDEEP SHRIVASTAV on Free EDR Certification Training
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Erdal on Siber Güvenlik Saldiri ve Savunma Stratejileri – NEW B00K

Archives

Dr. Erdal Ozkaya © Copyright 2023. All Rights Reserved.