If I send a DNSQR for www.google.com using sr1 I get several DNSRR(s) in reply, such as (done using ans[DNSRR].show()
):
###[ DNS Resource Record ]###
rrname= 'www.google.com.'
type= A
rclass= IN
ttl= 294
rdlen= 4
rdata= '173.194.35.176'
###[ DNS Resource Record ]###
rrname= 'www.google.com.'
type= A
rclass= IN
ttl= 294
rdlen= 4
rdata= '173.194.35.178'
###[ DNS Resource Record ]###
....
Is there a neat way to iterate over those DNSRR(s)? As is I use regex and the following code:
def get_ip_addr(s):
pattern = r'[0-9]+(?:\.[0-9]+){3}'
match = re.search(pattern, s)
if match:
return match.group()
return None
def resolve_host(host, nserver):
print "resolving host: " + host + " (using nserver: " + nserver + ")"
dns_pkt = IP(dst=nserver)/UDP()/DNS(rd=1, qd=DNSQR(qname=host))
ans = sr1(dns_pkt)
if ans:
print "IP(s) for %s:" % (host)
dnsrr_strings = repr(ans[DNSRR]).split("|")
for dnsrr in dnsrr_strings :
ip_addr = get_ip_addr(dnsrr)
if ip_addr:
print " %s" % ip_addr
else:
sys.stderr.write("unable to lookup " + host)
If we send a dns request with scapy, we can get dns response as follow:
>>> dns.show()
###[ DNS ]###
id= 43223
qr= 1L
opcode= QUERY
aa= 0L
tc= 0L
rd= 1L
ra= 1L
z= 0L
rcode= ok
qdcount= 1
ancount= 3
nscount= 0
arcount= 0
\qd\
|###[ DNS Question Record ]###
| qname= 'search.yahoo.com.'
| qtype= A
| qclass= IN
\an\
|###[ DNS Resource Record ]###
| rrname= 'search.yahoo.com.'
| type= CNAME
| rclass= IN
| ttl= 5
| rdlen= 39
| rdata= 'ds-global.l7.search.ystg1.b.yahoo.com.'
|###[ DNS Resource Record ]###
| rrname= 'ds-global.l7.search.ystg1.b.yahoo.com.'
| type= CNAME
| rclass= IN
| ttl= 96
| rdlen= 43
| rdata= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
|###[ DNS Resource Record ]###
| rrname= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
| type= A
| rclass= IN
| ttl= 94
| rdlen= 4
| rdata= '188.125.66.104'
ns= None
ar= None
qdcount - query dns count,
ancount - dns answer count,
dns.an[0] is the 1st DNSRR,
dns.an[1] is the 2nd DNSRR,
...
we can parse DNSRR with ancount, here is my demo code:
#!/usr/bin/env python
# -*- coding: utf8 -*-
from scapy.all import *
# disable verbose mode
conf.verb = 0
def parse_dnspkt(pkt):
""" parse dns request / response packet """
if pkt and pkt.haslayer('UDP') and pkt.haslayer('DNS'):
ip = pkt['IP']
udp = pkt['UDP']
dns = pkt['DNS']
# dns query packet
if int(udp.dport) == 53:
qname = dns.qd.qname
print "\n[*] request: %s:%d -> %s:%d : %s" % (
ip.src, udp.sport,
ip.dst, udp.dport,
qname)
# dns reply packet
elif int(udp.sport) == 53:
# dns DNSRR count (answer count)
for i in range(dns.ancount):
dnsrr = dns.an[i]
print "[*] response: %s:%s <- %s:%d : %s - %s" % (
ip.dst, udp.dport,
ip.src, udp.sport,
dnsrr.rrname, dnsrr.rdata)
def sniffer():
sniff(filter="udp port 53", prn=parse_dnspkt)
if __name__ == "__main__":
sniffer()
Execute nslookup search.yahoo.com and nslookup stackoverflow.com in your shell.
root:scapy/ # python scapy-dns_sniff.py
WARNING: No route found for IPv6 destination :: (no default route?)
[*] request: 192.168.1.108:59199 -> 192.168.1.1:53 : search.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : search.yahoo.com. - ds-global.l7.search.ystg1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-global.l7.search.ystg1.b.yahoo.com. - ds-any-global.l7.search.ysta1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-any-global.l7.search.ysta1.b.yahoo.com. - 188.125.66.104
[*] request: 192.168.1.108:55391 -> 192.168.1.1:53 : stackoverflow.com.
[*] response: 192.168.1.108:55391 <- 192.168.1.1:53 : stackoverflow.com. - 198.252.206.16
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With