Question.3684 - Hosts File Attack Substituting a fraudulent IP address can be done by either attacking the Domain Name System (DNS) server or the local host table. Attackers can target a local hosts file to create new entries that will redirect users to their fraudulent site. Before DNS the local host file was used to match domain names to and IP address. Today companies can use the HOST file to make accessing internal web pages easier for employees. If a company wants users to access the human resource webpage by typing HR in the browser window they can use the HOST file to match the website IP address to the name HR. The computer will always check the HOST file before going outside to a DNS server. In this project, you will add a fraudulent entry to the local hosts file. Open a DOS prompt and ping www.google.comWrite down the IP address that was resolved to www.google.comPinging www.google.com [142.250.115.103] with 32 bytes of data: Reply from 142.250.115.103: bytes=32 time=294ms TTL=59 Reply from 142.250.115.103: bytes=32 time=473ms TTL=59 Reply from 142.250.115.103: bytes=32 time=337ms TTL=59 Reply from 142.250.115.103: bytes=32 time=333ms TTL=59 Ping statistics for 142.250.115.103: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 294ms, Maximum = 473ms, Average = 359ms Start Internet Explorer. Go to the www.ebay.com to verify that the domain is correctly resolved. At the command prompt type the command ipconfig /flushdns Click Start and All Programs and then Accessories. Right-click Notepad and then select Run as administrator. Click File and then Open. Click the File Name drop-down arrow to change from Text Documents (*.txt) to All files (*.*). Navigate to the file C:\windows\system32\drivers\etc\hosts and open it. At the end of the file, enter the IP address you wrote down. This is the IP address of Google. Press Tab and enter www.ebay.com. In this hosts table, www.ebay.com is now resolved to the IP address you entered. Click File and then Save. Open your Web browser and then enter the URL www.ebay.com. What Web site appears? Submit a copy of the HOST file with the entry to the dropbox for this lab. Return to the hosts file and remove this entry. Click File and then Save. Close all windows. If you use Spybot for spyware, you should have many entries in your HOST files with the IP address of 127.0.0.1. This address is known as a loopback address and points back to your PC. So sites that SPYBOT knows are malware sites, it point them back to your PC so you can never go to the site.

Answer Below: