使用 Pcap 和 C 进行 DNS 查找
我正在尝试使用 Pcap 库和 C 代码执行 DNS 攻击。目前我可以： 1. 读取 DNS 查询 2. 根据 DNS 查询，创建 DNS 答案并注入恶意 IP。 3. 将虚假响应注入回网络。
使用 Wireshark 时，我可以看到我的数据包已成功注入网络。然而IP地址没有改变，即在ns查找时，它说“连接超时；无法访问服务器”。相反，它接受来自 DNS 服务器的实际响应。
知道为什么这不起作用吗？我哪里可能出错了？
I'm trying to perform DNS attacks using Pcap library and C code. Currently I can: 1. Read a DNS query 2. Based on the DNS query, create a DNS answer and inject the malicious IP. 3. Inject the fake response back into the network.
While using Wireshark, i can see my packet is successfully injected to the network. Yet the IP address is not changed i.e. on ns lookup, it says 'connection times out;no servers could be reached'. Instead it accepts the actual response from the DNS server.
Any idea why this isn't working? Where could i be going wrong?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
确保交易 ID 匹配。另外，根据客户端的不同，您可能需要欺骗源 IP 地址。 TTL 可能很重要，但如果它很小，即根据 RFC 1035，可能会阻止超过 1 周。
另请注意，第一个有效的 DNS 响应是被接受的响应。因此，您需要确保您的回复速度比其他服务器更快。
这也可能有帮助 http://www.sans.org/reading_room /whitepapers/dns/dns-spoofing-man-middle_1567。
Make sure that the transaction ID matches. Also depending on the client you may need to spoof the source IP address. TTL can matter but not if it is small, i.e. Over 1 week can be blocked, as per RFC 1035.
Also note that the first valid DNS response is the one that get accepted. So you will need to ensure that you reply is faster than the other server.
This may also help http://www.sans.org/reading_room/whitepapers/dns/dns-spoofing-man-middle_1567.
也许您生成的数据包有问题。您是否更新了所需的标志并设置了正确的部分？并正确复制交易ID？
在创建新答案之前，您可以尝试捕获真实答案并对其进行修改。
作为旁注，我建议使用 Python 进行此练习，编码更简单；-)
Perhaps there is something wrong with your generated packet. Are you updating the required flags and setting the correct sections? And copying the transaction ID correctly?
You could try capturing a real answer and modifying that, before creating a new answer.
As a sidenote, I'd recommend using Python for this exercise, much simpler coding ;-)
首先，确保您的假服务器可以响应直接发送给它的数据包，这样它就不必“赢得比赛”才能首先到达。
然后，您可以使用简单的
dig命令来确保您确实符合 DNS 协议规范。除了这里提到的其他事情之外，您还需要确保数据包在 IP 层也是一致的。如果您要欺骗响应，则需要确保 IP 校验和字段已正确计算 - 如果不正确，您的数据包可能永远不会到达预期受害计算机的更高级别。
First, make sure you can make your fake server respond to packets directly sent to it so that it's not having to "win the race" to arrive first.
You can then use simple
digcommands to ensure that you're actually conformant with the DNS protocol specifications.Apart from the other things mentioned here, you'll also need to ensure that your packets are consistent at the IP layer too. If you're spoofing a response you'll need to ensure that the IP checksum field has been correctly calculated - if it's incorrect your packets may never reach the intended victim machine's higher levels.