Metasploit Revealed: Secrets of the Expert Pentester

Host file injection with Metasploit

We can perform a variety of phishing attacks on the target by injecting the host file. We can add entries to the host file for specific domains and then can leverage our phishing attacks with ease.

Let's see how we can perform host file injection with Metasploit:

We can see that we used the post/windows/manage/inject_host module on session 1 and inserted the entry into the target's host file. Let's see what happens when a target opens yahoo.com:

We can see that the target is redirected to our malicious server, ...