[Autogenerated] For this demo,
we'll be using the Linux endpoint and once again in a terminal,
let's take a look at the endpoints DNS server
configuration in most UNIX based systems.
This is found in the resolve dot com file.
The name server is the IP address of the DNS server.
In this case,
12700.53 is listed because the system D resolved service is running.
This is a bit outside the scope of this lab,
but this service manages the DNS routing and local cache for this endpoint.
This is also typical for cloud hosted endpoints.
You can also have multiple name servers listed here.
The search is a fully qualified domain to use if a shorthand name is given.
For example, if you perform a look up to 80 server one and it's not found,
it will then attempt to find a server one dot us west two dot compute
dot internal options allows for certain modifications.
In our example.
S zero allows for larger replies and trust ad is a
configuration for DNSSEC and validating responses.
Now let's look at the endpoints host file.
This is a static mapping of domain names with IP addresses.
This file has not been modified and shows a typical configuration.
If you were to send a request to local host,
an external DNS request is not necessary because a match already
exists in the host file and will translate to 127001.
We can see this translation in action by sending a ping request.
Now we're going to try modifying the host file.
An attacker endpoint has been pre configured in our environment
at 1 72 31 24.88 we'll add a line in the hosts file and redirect
Pluralsight dot com to the attacker.
We can verify this worked by performing an S look up and the
return to answer is just what we configured.
Now, let's try browsing to the page.
I'll open a new private window in Firefox to bypass the browser cache
and browse to HTTP www dot plural site dot com.
The browser will still attempt to connect to HTTPS.
But since I didn't set up certificates for the attacker,
we'll need to manually type HTTP for demonstration.
In this example,
it's easy to see that we're not browsing to the legitimate plural site page,
but it's not too difficult to see how an attacker can redirect you to a
legitimate looking page all by changing one line.