4 ms·

Every system has a hosts file that you can edit for exactly this purpose. No need to set up DNS at all. Your system will resolve whatever hostnames you want t

Every system has a hosts file that you can edit for exactly this purpose. No need to set up DNS at all. Your system will resolve whatever hostnames you want to whatever IP addresses you want. You just add the entries to a text file. It will always override whatever results come from DNS. The author definitely went the long way with this approach.

flatiron 5y ago
was it https? makes it a bit trickier if it is as you would have to self sign the cert. guy is use ida pro. i assume they know how dns works
pixl97 5y ago
That is if you're using a single host network. If your simulations go beyond a single VM it can be useful. In general when performing malware analysis you want a logging DNS cache to keep track of any lookup the software makes.
BillDemirkapi 5y ago
Author here. Yes simply editing my hosts file would have been much easier. The reason I went the longer approach of setting up the payload on a remote web server was because there is the concept of security zones in Internet Explorer. Visiting localhost in Internet Explorer gets treated with a different level of trust compared to randomwebsite.com. For example, if you go to your security settings in Internet Explorer, there is an "Internet" zone but also a "Local intranet" zone. If you compare the two, you'll see they have different security settings. By hosting the payload on an external domain, we ensure that we are simulating an identical environment that existed for the attack (and are not subject to a different level of trust).
- EvanAnderson 5y ago
  Editing the HOSTS file has nothing to do with where the resource is hosted. It just allows you to control name resolution without doing it in DNS. Internet Explorer security zones work the same way irrespective of whether a local HOSTS file for DNS resolves the name.
  - BillDemirkapi 5y ago
    Yes, but at the time I already had an existing domain with a web server I could use. You are correct that I could have setup a separate site for hidusi[.]com and then point the domain directly at my web server's IP, but since I already had a domain/web server configured, it was much easier just to swap the domain in the document.
    - kjaftaedi 5y ago
      Your comments give me the impression this isn't totally clicking just yet. All that is necessary is to add an entry in your hosts file for hidusi[.]com that points to the IP of your existing server. That's it. Step completed. No localhost, no new site, just using what you have already. In the event you are filtering hostnames on your web server, you would just add hidusi[.]com as another alias. Please let me know if this is not clear because I believe understanding this concept will help you in the future.
      - BillDemirkapi 5y ago
        I can assure you the answer clicked before my research ever started. Unless I am using web server software that responds with one site for multiple host names, you generally need to configure each host name that might be used with your web server as a different "site" (i.e Apache) / configuration. I could have simply edited my hosts file with hidusi[.]com pointing to my web server and created a separate site configuration to serve the hidusi[.]com domain with the second stage. What I was saying in my last response was that instead of using my hosts and having to create this new site configuration (or modify existing with an alias), I could just swap out the domain in the document and use my web server's current state without any additional modification required. It was simply more convenient to change a single domain rather than update my web server's configuration to support requests for the hidusi[.]com alias. There is no significance to using the original domain for serving the second stage, I think you all are all just overthinking it :)
        kjaftaedi 5y ago
rasz 5y ago
>Your system will resolve whatever hostnames you want to whatever IP addresses you want. You just add the entries to a text file. >It will always override whatever results come from DNS. there are limitations, good luck overriding ctldl.windowsupdate.com https://forums.mydigitallife.net/threads/windows-10-hosts-file-not-able-to-block-certain-microsoft-sites.63405/ https://forums.mydigitallife.net/threads/windows-10-hosts-fi...

flatiron 5y ago

was it https? makes it a bit trickier if it is as you would have to self sign the cert. guy is use ida pro. i assume they know how dns works

pixl97 5y ago

That is if you're using a single host network. If your simulations go beyond a single VM it can be useful. In general when performing malware analysis you want a logging DNS cache to keep track of any lookup the software makes.

BillDemirkapi 5y ago

Author here. Yes simply editing my hosts file would have been much easier. The reason I went the longer approach of setting up the payload on a remote web server was because there is the concept of security zones in Internet Explorer. Visiting localhost in Internet Explorer gets treated with a different level of trust compared to randomwebsite.com. For example, if you go to your security settings in Internet Explorer, there is an "Internet" zone but also a "Local intranet" zone. If you compare the two, you'll see they have different security settings. By hosting the payload on an external domain, we ensure that we are simulating an identical environment that existed for the attack (and are not subject to a different level of trust).

EvanAnderson 5y ago
Editing the HOSTS file has nothing to do with where the resource is hosted. It just allows you to control name resolution without doing it in DNS. Internet Explorer security zones work the same way irrespective of whether a local HOSTS file for DNS resolves the name.
- BillDemirkapi 5y ago
  Yes, but at the time I already had an existing domain with a web server I could use. You are correct that I could have setup a separate site for hidusi[.]com and then point the domain directly at my web server's IP, but since I already had a domain/web server configured, it was much easier just to swap the domain in the document.
  - kjaftaedi 5y ago
    Your comments give me the impression this isn't totally clicking just yet. All that is necessary is to add an entry in your hosts file for hidusi[.]com that points to the IP of your existing server. That's it. Step completed. No localhost, no new site, just using what you have already. In the event you are filtering hostnames on your web server, you would just add hidusi[.]com as another alias. Please let me know if this is not clear because I believe understanding this concept will help you in the future.
    - BillDemirkapi 5y ago
      I can assure you the answer clicked before my research ever started. Unless I am using web server software that responds with one site for multiple host names, you generally need to configure each host name that might be used with your web server as a different "site" (i.e Apache) / configuration. I could have simply edited my hosts file with hidusi[.]com pointing to my web server and created a separate site configuration to serve the hidusi[.]com domain with the second stage. What I was saying in my last response was that instead of using my hosts and having to create this new site configuration (or modify existing with an alias), I could just swap out the domain in the document and use my web server's current state without any additional modification required. It was simply more convenient to change a single domain rather than update my web server's configuration to support requests for the hidusi[.]com alias. There is no significance to using the original domain for serving the second stage, I think you all are all just overthinking it :)
      - kjaftaedi 5y ago

rasz 5y ago

>Your system will resolve whatever hostnames you want to whatever IP addresses you want. You just add the entries to a text file. >It will always override whatever results come from DNS. there are limitations, good luck overriding ctldl.windowsupdate.com https://forums.mydigitallife.net/threads/windows-10-hosts-file-not-able-to-block-certain-microsoft-sites.63405/ https://forums.mydigitallife.net/threads/windows-10-hosts-fi...