summitt / Nope-Proxy

TCP/UDP Non-HTTP Proxy Extension (NoPE) for Burp Suite.
1.54k stars 235 forks source link

Spoof ONLY DNS entries listed in the hosts file #40

Closed dkasak closed 1 year ago

dkasak commented 4 years ago

If I understand it right, the "Use the above 'DNS Response IP' ..." checkbox makes all DNS responses return the IP address listed in the "DNS Response Ip" field, except for those for which there is a record in the "Custom Hosts file".

Is there instead a way of making NoPE return real DNS entries except for those domains listed in the hosts file?

So if my hosts file contains

15.15.15.15  a.a.a.a
16.16.16.16  b.b.b.b

I'd like NoPE to return 15.15.15.15 for a.a.a.a (and similarly for b.b.b.b), but for all other domains, I'd like it to return the actual IP by calling an actual resolver.

dkasak commented 4 years ago

I just saw this line in the README:

If this box is not checked then the extension will resolve the Real IP address unless it has been overridden in the ‘Custom Hosts File’

So it seems it already works like this. What confused me is that when NoPE is set up like this, the Resolved Ip field in the DNS History tab showed the real IP address for an entry in the custom hosts file. However, it still seems to resolve correctly (to the hosts file IP address). So maybe this is a UI issue?

summitt commented 4 years ago

I'll look into it. Must be a UI bug. What system are you running the extension on?

dkasak commented 4 years ago

java-11-openjdk on Arch Linux.