dns_logger.py

## dns_logger.py
#!/usr/bin/env python
import sys
import random
import string
import datetime
import itertools
import threading
import traceback
import SocketServer
import operator as op
import dnslib
import flask
from flask import request

_response_ip = '8.8.8.8'  # IP to respond with
_lookups_lock = threading.Lock()
_lookups = []

app = flask.Flask(__name__)
app.config.from_object(__name__)


class BaseRequestHandler(SocketServer.BaseRequestHandler):

    def get_data(self):
        raise NotImplementedError

    def send_data(self, data):
        raise NotImplementedError

    def handle(self):
        now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
        (ip_addr, port) = self.client_address
        try:
            data = self.get_data()
            if data is None:
                return
            request = dnslib.DNSRecord.parse(data)
            domains = [".".join(q.qname.label) for q in request.questions]
            domain = ".".join(request.q.qname.label)
            print "[+] Got a request for '{}' from: {}".format(domain, ip_addr)
            with _lookups_lock:
                _lookups.append((now, domain, ip_addr,))
            reply = dnslib.DNSRecord(dnslib.DNSHeader(id=request.header.id), q=request.q)
            reply.add_answer(dnslib.RR(rname=q.qname,
                rtype=dnslib.QTYPE.A, rclass=1, ttl=60*5, rdata=dnslib.A(_response_ip)))
            self.send_data(reply.pack())
        except Exception:
            traceback.print_exc(file=sys.stderr)


class TCPRequestHandler(BaseRequestHandler):

    def get_data(self):
        data = self.request.recv(8192).strip()
        sz = int(data[:2].encode('hex'), 16)
        if sz < len(data) - 2:
            return None
            #raise Exception("Wrong size of TCP packet")
        elif sz > len(data) - 2:
            return None
            #raise Exception("Too big TCP packet")
        return data[2:]

    def send_data(self, data):
        sz = hex(len(data))[2:].zfill(4).decode('hex')
        return self.request.sendall(sz + data)


class UDPRequestHandler(BaseRequestHandler):

    def get_data(self):
        return self.request[0].strip()

    def send_data(self, data):
        return self.request[1].sendto(data, self.client_address)


def html_encode(s):
    for code in [("'", '&#39;'), ('"', '&quot;'), ('>', '&gt;'), ('<', '&lt;'), ('&', '&amp;')]:
        s = s.replace(code[0], code[1])
    return s


@app.route('/s/<_id>/')
def status(_id):
    key_func = op.itemgetter(1)
    hits = []
    for k, grp in itertools.groupby(sorted(_lookups, key=key_func), key=key_func):
        if k == _id:
            hits = ["[{}] {}".format(_[0], html_encode(_[2])) for _ in grp]
    return """<html><pre>{}</pre></html>""".format(hits and "\n".join(hits) or 'No Lookups')


@app.route('/')
def index():
    hits = ["[timestamp] - client ip - hostname"]
    _sorted = sorted(_lookups, key=op.itemgetter(0))
    hits.extend(["[{}] - {} - {}".format(_[0], _[2], html_encode(_[1])) for _ in _sorted])
    return """<html><pre>Recent Lookups:\n{}</pre></html>""".format("\n".join(hits))


if __name__ == "__main__":
    print "Starting nameservers..."
    servers = [
        SocketServer.ThreadingUDPServer(('', 53), UDPRequestHandler),
        SocketServer.ThreadingTCPServer(('', 53), TCPRequestHandler)]

    for s in servers:
        thread = threading.Thread(target=s.serve_forever)
        thread.daemon = True
        thread.start()

    print "Starting webserver..."
    try:
        app.run(host='0.0.0.0', port=8000, debug=True, use_reloader=False)
    except KeyboardInterrupt:
        pass
    finally:
        map(lambda s: s.shutdown(), servers)