Last active
August 28, 2018 14:19
-
-
Save nv1t/3d46c41b27d7d69ed3d46d1f3d74d1a6 to your computer and use it in GitHub Desktop.
It opens up a DNS Server which answers for all domains with your own IP. Nice for fast intercepting of DNS queries :)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import socket | |
import sys | |
class DNSQuery: | |
def __init__(self, data): | |
self.data=data | |
self.domain='' | |
typ = (ord(data[2]) >> 3) & 15 # Opcode bits | |
if typ == 0: # Standard query | |
ini=12 | |
lon=ord(data[ini]) | |
while lon != 0: | |
self.domain+=data[ini+1:ini+lon+1]+'.' | |
ini+=lon+1 | |
lon=ord(data[ini]) | |
def response(self, ip): | |
packet='' | |
if self.domain: | |
packet+=self.data[:2] + "\x81\x80" | |
packet+=self.data[4:6] + self.data[4:6] + '\x00\x00\x00\x00' # Questions and Answers Counts | |
packet+=self.data[12:] # Original Domain Name Question | |
packet+='\xc0\x0c' # Pointer to domain name | |
packet+='\x00\x01\x00\x01\x00\x00\x00\x3c\x00\x04' # Response type, ttl and resource data length -> 4 bytes | |
packet+=str.join('',map(lambda x: chr(int(x)), ip.split('.'))) # 4bytes of IP | |
return packet | |
if __name__ == '__main__': | |
ip=sys.argv[1] | |
print 'pyDNS:: dom.query. 60 IN A %s' % ip | |
udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) | |
udps.bind(('',53)) | |
try: | |
while 1: | |
data, addr = udps.recvfrom(1024) | |
p=DNSQuery(data) | |
if p.domain == '<some domain>.': | |
udps.sendto(p.response(ip), addr) | |
print 'Response: %s -> %s' % (p.domain, ip) | |
else: | |
try: | |
otherIP = socket.gethostbyname(p.domain) | |
except: | |
print 'ERRPR: '+p.domain | |
udps.sendto(p.response(otherIP), addr) | |
print 'Response: %s -> %s' % (p.domain, otherIP) | |
except KeyboardInterrupt: | |
print 'Colosing' | |
udps.close() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment