Class 08 · KP 08 / 20

Faking the Internet: FakeNet-NG and INetSim

Malware often does nothing useful without network — it wants to resolve DNS, fetch a payload, or beacon to C2.
FakeNet-NG / INetSim intercept all outbound traffic and answer with simulated services (DNS, HTTP/S, FTP, SMTP).
The malware "thinks" it is online; you capture its DNS queries, HTTP requests, user-agents, and C2 URLs — fully offline.
Combine with Wireshark for raw packet capture and to confirm exactly what left the box.

Key Takeaway

Give the malware a fake internet so it reveals its C2 without ever touching the real one.