dns_despoof.tcl

#
# DNS Despoofer
# Emanuele "crossbower" Acri - 2010
#
# Usage:
# hping3 exec dns_despoof.tcl <server> <interface> (<action:search|crash>)
#

#
# Search spoofers
#
proc search_spoofers { server interface } {

    # prepare and send DNS probe
    set probe {ip(daddr=192.168.0.1,ttl=64)+udp(dport=53,sport=44556)+data(str=\2f\69\01\00\00\01\00\00\00\00\00\00\06\67\6f\6f\67\6c\65\03\63\6f\6d\00\00\01\00\01\70\69\7a\7a\61)};

    set probe [hping setfield ip daddr $server $probe];

    # send probe
    hping send $probe;

    # sniff loop
    while { 1 } {

        # sniff a single packet
        set p [lindex [hping recv $interface] 0];

        # is it the DNS response?
        if { [hping getfield ip proto $p] != 17 || [hping getfield ip saddr $p] != $server || [hping getfield udp sport $p] != 53 || [hping getfield udp dport $p] != 44556 } { continue }

        # get data
        set res_data [hping getfield data str $p];
        set result [string match "*pizza*" $res_data];

        if { $result == 0 } {
            puts "No spoofer detected...";
        } else {
            puts "SPOOFER DETECTED!";
        }

        break;
    }
}

#
# Crash spoofers
#
proc crash_spoofers { server interface } {

    # prepare and send DNS probe
    set probe {ip(daddr=192.168.0.1,ttl=64)+udp(dport=53,sport=44556)+data(str=\2f\69\01\00\00\01\00\00\00\00\00\00\06\67\6f\6f\67\6c\65\03\63\6f\6d\01\00\01\00\01\70\69\7a\7a\61)};

    set probe [hping setfield ip daddr $server $probe];

    # send probe
    hping send $probe;

    puts "Bullet fired... Try again to search for spoofers:\n1) No responses: the spoofer is probably crashed (windnsspoof).\n2) Responses: it's a well written spoofer (dnsspoof).";
}

#
# Usage
#
proc usage {} {
    puts "DNS Despoofer - Emanuele \"Crossbower\" Acri - 2010\nUsage:\n  hping3 exec dns_despoof.tcl <server> <interface> (<action:search|crash>)";
    exit 250;
}

#
# Main
#

#get dns server
set server [lindex $argv 0];
set interface [lindex $argv 1];
set action [lindex $argv 2];

# check args
if { $server == "" || $interface == "" } { usage }

# simple trick to initialize libpcap
set p [lindex [hping recv $interface 1] 0];

# check action
if { $action == "" || $action == "search" } {
    search_spoofers $server $interface;
} elseif { $action == "crash" } {
    crash_spoofers $server $interface;
} else {
    usage;
}

exit 0;