# DNS Spoofing & Hijacking

If ARP Spoofing redirects traffic based on physical MAC addresses, DNS Spoofing redirects traffic based on human-readable domain names. 

The Domain Name System (DNS) translates a website name like `bank.com` into the server's IP address (e.g., `192.0.2.50`). If an attacker can manipulate this translation process, they control where the user goes.

## Local DNS Spoofing (via MITM)
This is usually the next step after an attacker has successfully executed an ARP Spoofing Man-in-the-Middle attack.

1.  The victim types `www.bank.com` into their browser.
2.  The victim's computer sends a DNS Query asking for the IP of `bank.com`.
3.  Because the attacker is actively performing a MITM attack via ARP Spoofing, that DNS Query flows through the attacker's machine.
4.  The attacker intercepts the query and sends a fake DNS Reply back to the victim, claiming that `bank.com` is located at the Attacker's IP address (e.g., `10.0.0.66`).
5.  The victim's browser connects to the Attacker's web server, which is hosting a perfect, pixel-for-pixel fake clone of the bank's login page. 

The victim sees `www.bank.com` in the URL bar, but they are secretly typing their credentials into the attacker's database.

## DNS Cache Poisoning (Server-Side)
This is a much larger scale attack. Instead of attacking a single victim, the attacker targets a recursive DNS server (like the one operated by your ISP, or even a public one like Google's `8.8.8.8`).

The attacker exploits vulnerabilities in the DNS server software (like BIND) to inject fake records into the server's cache.
If successful, *everyone* who relies on that DNS server will be redirected to the malicious site when they try to visit `bank.com`. This affects thousands or millions of users simultaneously.

## Defending Against DNS Attacks
Because classic DNS operates over unencrypted UDP Port 53, it is highly vulnerable to tampering.
*   **DNSSEC (DNS Security Extensions):** Adds cryptographic digital signatures to DNS records. When your computer looks up `bank.com`, the true owner of `bank.com` signs the response with a private key. Your computer verifies the signature with a public key. If an attacker modifies the IP address in transit, the signature breaks, and your computer drops the fake response.
*   **DoH / DoT (DNS over HTTPS / TLS):** Encrypts the entire DNS conversation so a local MITM attacker cannot even see what domain you are querying, let alone modify the response.