Dns spoof plugin doesn't work

[Tatuck]

This is my etter.conf:

[Privs]
Ec_uid=0
Ec_gid=0
....

#if you use ipchains
#redir...
#redir...

#if you use iptables:
Redir...
Redir...

#pendant for IPv6
Redir6...
Redir6...

And this my etter.dns:

pepsi.com  A 192.168.1.50
*.pepsi.com  A 192.168.1.50
www.pepsi.com  PTR 192.168.1.50

And this is what I did:

Host a web in localhost Open ettercap Open hosts list and search hosts Select my victim in target 1 and the router target 2 Start arp poisoning with Sniff remote connections enabled Enable dns_spoof plugin

And this is what happens in the victim pc:

I search any webpage and it says: the web uses an unsupported protocol.

And when I search pepsi.com: Sometimes work sometimes not.

Is there any order to follow or something?

And why when I open other webpage, like Google, Wikipedia... It shows me the error of the unsupported protocol? I am not spoofing google or Wikipedia.

[koeppea]

This is because, you've enabled SSL interception. All SSL streams by default are intercepted and get presented to the victim with a (by default) self-signed certificate.

I you only want to do man-in-the-middle for DNS spoofing, I recommend letting the redi commands commented out in the etter.conf file.

If you really want to do SSL interception, I really recommend using the latest source code from GitHub, since there are a lot of fixes and improvements to the SSL related code. However, SSL interception is nowadays really tricky and quite some background knowledge is required to successfully break into SSL connections, and even for some websites it isn't possible at all, as they make use of certificate pinning on top.

So please retry to comment out the Redir commands. Setting the UID to 0 is also only required when you want to use the SSL Redir commands.

[Tatuck]

Oh thanks!