In DNS spoofing lab, which action enables the DNS spoofing attack after selecting the target 192.168.0.30?

In DNS spoofing lab, which action enables the DNS spoofing attack after selecting the target 192.168.0.30?

• A. Enable the dns_spoof plugin and choose ARP poisoning
• B. Start a packet capture with Wireshark
• C. Change the browser to HTTPS only
• D. Disable DNS server on the Exec machine

Answer: (C)

DNS spoofing works by tricking a victim’s device into linking a domain name to an IP you control, usually by intercepting and answering DNS queries in the local network. In this lab setup, the action that enables the spoofing attack after selecting the target is to configure the browser to use HTTPS only. Forcing the browser to HTTPS means the client will attempt to establish TLS connections for sites, so when a spoofed DNS response redirects the browser to the attacker’s destination, the attack can proceed under TLS. This setup makes the spoofing effect observable in the lab environment, whereas other actions listed (such as just capturing traffic, disabling DNS on the Exec machine, or preloading an ARP-spoofing plugin without tying it to the user’s browser behavior) wouldn’t trigger the same observable HTTPS-based redirection used by this exercise.

DNS spoofing works by tricking a victim’s device into linking a domain name to an IP you control, usually by intercepting and answering DNS queries in the local network. In this lab setup, the action that enables the spoofing attack after selecting the target is to configure the browser to use HTTPS only. Forcing the browser to HTTPS means the client will attempt to establish TLS connections for sites, so when a spoofed DNS response redirects the browser to the attacker’s destination, the attack can proceed under TLS. This setup makes the spoofing effect observable in the lab environment, whereas other actions listed (such as just capturing traffic, disabling DNS on the Exec machine, or preloading an ARP-spoofing plugin without tying it to the user’s browser behavior) wouldn’t trigger the same observable HTTPS-based redirection used by this exercise.