L in u X ba sics for h acke rs g e t t I n g s t a r t e d w I t h

36
Chapter 3
Mapping Your Own IP Addresses
A special file on your system called the hosts file also performs domain name–
IP address translation. The hosts file is located at /etc/hosts, and kind of as with 
DNS, you can use it to specify your own IP address–domain name mapping. 
In other words, you can determine which IP address your browser goes to 
when you enter www.microsoft.com (or any other domain) into the browser, 
rather than let the DNS server decide. As a hacker, this can be useful for 
hijacking a TCP connection on your local area network to direct traffic to a 
malicious web server with a tool such as 
dnsspoof
.
From the command line, type in the following command (you can sub-
stitute your preferred text editor for 
leafpad
):
kali >leafpad /etc/hosts
You should now see your hosts file, which will look something like 
Figure 3-3.
Figure 3-3: A default Kali Linux hosts file
By default, the hosts file contains only a mapping for your localhost, at 
127.0.0.1, and your system’s hostname (in this case, Kali, at 127.0.1.1). But you 
can add any IP address mapped to any domain you’d like. As an example of 
how this might be used, you could map www.bankofamerica.com to your local 
website, at 192.168.181.131.
127.0.0.1 localhost
127.0.1.1 kali
192.168.181.131 bankofamerica.com
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
Make certain you press 
tab
between the IP address and the domain 
key—not the spacebar.
As you get more involved in your hacking endeavors and learn about 
tools like 
dnsspoof
and Ettercap, you’ll be able to use the hosts file to direct 
any traffic on your LAN that visits www.bankofamerica.com to your web server 
at 192.168.181.131.
Pretty easy, right?

---

Analyzing and Managing Networks