We're just about ready. Once we start Evilgrade, it will stand up a web server and wait for requests. That means we need the target to request the update from our Evilgrade server while thinking it's talking to one of the three domains we just noted previously. Simply put: we need to spoof DNS. We're also going to need to route local traffic through our interface, so let's use our trusty ARP poisoning attack for that purpose. So, we need to perform a targeted ARP and DNS attack against one host on the LAN and three specific domains on the internet – an ideal job for Ettercap while leveraging its DNS proxy module.
The DNS proxy module allows us to target domains by referencing its internal DNS mapping, ...
