Lion Cipher Lab
Trace how Linux turns a hostname into an IP address, and catch a hosts-file override
- Foundations
- Beginner
- ~45 min
- Free · no account required
Why it matters
Every time a program connects to a name -- your bank's website, a software update server, an API -- something has to turn that name into an IP address first. That step is called NAME RESOLUTION, and on Linux it is not just 'ask DNS'. There is a local file, /etc/hosts, that is checked first, and whatever it says wins. That makes it a favourite of adware and malware: add one line and the victim's computer quietly sends 'www.yourbank.example' to an attacker's server, or sends the antivirus update site to nowhere, while DNS itself looks perfectly healthy. It also causes honest confusion every…
What you'll learn
- reading the 'hosts:' line in /etc/nsswitch.conf and saying, in order, where a Linux program looks to turn a name into an address
- knowing which tools follow that order (getent, curl, ping, most programs) and which skip /etc/hosts and ask DNS directly (dig, nslookup)
- resolving the classic 'dig says X but the app connects to Y' confusion in under a minute with getent
- planting and then catching a hosts-file override three ways: diff against a known-good copy, a SHA-256 hash check, and a getent-versus-dig disagreement count
- restoring /etc/hosts safely (copy in place, not mv) and proving the fix with the same measurements
- the limits of each check: names you did not list, legitimate entries, IPv4-only overrides, files that containers and WSL regenerate, and browsers that use DNS over HTTPS
Steps in this lab
- Open a throwaway Linux box and install the lookup tools
- Read the three files that decide where a name goes
- getent asks the way programs ask; dig asks DNS only
- Save a known-good baseline BEFORE anything goes wrong
- Play the attacker: plant a hosts-file override
- Catch it three ways, and count
- Why reordering nsswitch.conf is not a fix
- Fix it properly, and prove the fix with the same numbers
- The honest negative: what these checks cannot tell you
- The judgment: which tool for which question