I am trying to create a mini malware analysis environment between a few MacOS VMs to analyse the network activity of MacOS malwares.
Some context about the VMs:
- Both VM are MacOS Catalina 10.15
- Both are in a private network (Both VMs can ping each other)
I have installed Python3 on VM2 and installed fakedns to simulate as a DNS server.
I have also changed the DNS server of VM1 to point towards VM2 by using the following steps:
- System Preferences
- Under Ethernet, click "Advanced"
- Select "DNS" tab and click "+" and entered the IP address of VM2.
- Clicked "Ok" and "Apply" to apply changes.
At this time, I also started the FakeDNS by entering
sudo python3 fakedns.py <IP address of VM2>
However, when I did
nslookup something.com on VM1, (based on my Wireshark capture), it went out via loopback port and not the ethernet port. [Refer to picture below, this Wireshark capture was taken from VM1]
When I entered
nslookup anything.com <IP address of VM2>, I managed to get the response. However, if I am to enter
nslookup anything.com, it goes via the default connection. Is there a way to change the default DNS path??
nslookup anything.com after setting the default route, and flushing my DNS cache, but it still doesn't work.