A penetration tester has established an on-path position between a target host and local network services but has not been able to establish an on-path position between the target host and the…

Gaining access to the target host and implanting malware is more invasive and less subtle than redirecting traffic via DNS manipulation, and may not be necessary if network-level control is sufficient.

By exploiting the local DNS server and adding or updating zone records with a spoofed A record, the attacker can ensure that any client requesting a specific domain name within the local network receives the attacker's controlled IP address. This method is subtle as the client's DNS query appears normal, and the redirection happens at the name resolution stage without direct manipulation of the target host or its connections.

Using Scapy to overwrite name resolution fields in DNS query responses involves active, real-time packet manipulation, which can be less subtle and persistent than directly modifying the DNS server's records, especially given the constraint of not having on-path access to the Internet.

Proxying HTTP connections typically requires configuring the target to use a proxy or establishing a transparent proxy that can intercept all traffic, which might not be subtle or feasible without full on-path Internet access.