FakeNet-NG Cheatsheet
What It Is
Network simulation tool that intercepts and redirects all network traffic to localhost.
Why It Matters
Lets malware "think" it has internet access without actually connecting to real C2 servers.
Quick Start
# Run as Administrator
fakenet.exe
# Or with custom config:
fakenet.exe -c fakenet.cfg
What It Simulates
| Protocol | Behavior |
|---|---|
| DNS | Responds to all queries with local IP |
| HTTP/HTTPS | Serves dummy pages, logs requests |
| SMTP | Captures outgoing emails |
| FTP | Accepts uploads, logs files |
| IRC | Basic IRC server simulation |
| Custom TCP/UDP | Raw logging |
Reading the Output
- Watch the console for intercepted connections
- Check log files in
fakenet_logs/directory - PCAP output available for Wireshark analysis
Common Mistakes
- Running without Administrator privileges
- Conflicts with other network tools (disable Windows Firewall)
- Not checking logs after analysis