iphelix / dnschef

DNSChef - DNS proxy for Penetration Testers and Malware Analysts
BSD 3-Clause "New" or "Revised" License
892 stars 208 forks source link

Two or more records per domain #16

Open s0i37 opened 6 years ago

s0i37 commented 6 years ago

Hello. How can I specify many records for something domain, like this: *zone.com=1.2.3.4, 5.6.7.8

gokalper commented 3 years ago

HI This would be really useful, I also need this functionality

adfoster-r7 commented 11 months ago

Would love this functionality too :+1:

adfoster-r7 commented 11 months ago

I hacked this in to support only the scenario that I needed, ipv4 and ipv6 lookups.

Multiple values are separated by commas:

sudo -E python3 ./dnschef.py --interface 0.0.0.0 --fakeip '127.0.0.1,192.168.200.201' --fakeipv6 '2001:db8:3333:4444:5555:6666:7777:8888,2001:db8:3333:4444:5555:6666:7777:5555'

Changes:

diff --git a/dnschef.py b/dnschef.py
index c57924d..bfe509b 100755
--- a/dnschef.py
+++ b/dnschef.py
@@ -127,9 +127,17 @@ class DNSHandler():
                     log.info(f"{self.client_address[0]}: cooking the response of type '{qtype}' for {qname} to {fake_record}")

                     # IPv6 needs additional work before inclusion:
+
                     if qtype == "AAAA":
-                        ipv6_hex_tuple = list(map(int, ip_address(fake_record).packed))
-                        response.add_answer(RR(qname, getattr(QTYPE,qtype), rdata=RDMAP[qtype](ipv6_hex_tuple)))
+                        for ipv6 in fake_record.split(','):
+                            ipv6_hex_tuple = list(map(int, ip_address(ipv6).packed))
+                            response.add_answer(RR(qname, getattr(QTYPE,qtype), rdata=RDMAP[qtype](ipv6_hex_tuple)))
+
+                    elif qtype == "A":
+                        for ipv4 in fake_record.split(','):
+                            # dnslib doesn't like trailing dots
+                            if ipv4[-1] == ".": ipv4 = ipv4[:-1]
+                            response.add_answer(RR(qname, getattr(QTYPE,qtype), rdata=RDMAP[qtype](ipv4)))

                     elif qtype == "SOA":
                         mname,rname,t1,t2,t3,t4,t5 = fake_record.split(" ")