dnschef-ng

DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy (aka "Fake DNS") is a tool used for application network traffic analysis among other uses. For example, a DNS proxy can be used to fake requests for "badguy.com" to point to a local machine for termination or interception instead of a real host somewhere on the Internet. 

There are several DNS Proxies out there. Most will simply point all DNS queries a single IP address or implement only rudimentary filtering. DNSChef was developed as part of a penetration test where there was a need for a more configurable system. As a result, DNSChef is cross-platform application capable of forging responses based on inclusive and exclusive domain lists, supporting multiple DNS record types, matching domains with wildcards, proxying true responses for nonmatching domains, defining external configuration files, IPv6 and many other features. You can find detailed explanation of each of the features and suggested uses below.

The use of DNS Proxy is recommended in situations where it is not possible to force an application to use some other proxy server directly. For example, some mobile applications completely ignore OS HTTP Proxy settings. In these cases, the use of a DNS proxy server such as DNSChef will allow you to trick that application into forwarding connections to the desired destination.

## New Features 

- Requires Python 3.11+
- Supports staging files over DNS (only over `A`,`AAAA`,`TXT` for now...)
- Config file is now TOML
- Optional HTTP API (allows you to query logs and update config remotely)
- Fully async for increased performance (uses AsyncIO)
- Structured logging and a number of QOL improvements
- Is now a Python package
- Dockerized
- Includes a number of the PRs and fixes from the original repo

## Installing

To install the latest release you should use [pipx](https://pypa.github.io/pipx/) (unless you're a piece of shit who enjoys sloppy stakes):

    pipx install dnschef-ng

If you want the HTTP API (requires some extra dependencies):
    
    pipx install dnschef-ng[api]

Install latest version from Git using pipx:

     pipx install git+https://github.com/byt3bl33d3r/dnschef-ng.git

Install latest version from Git using pipx with the deps for the HTTP API:

     pipx install "git+https://github.com/byt3bl33d3r/dnschef-ng.git#egg=dnschef-ng[api]"


## Setting up a DNS Proxy

Before you can start using DNSChef, you must configure your machine to use a DNS nameserver with the tool running on it. You have several options based on the operating system you are going to use:

- **Linux** - Edit */etc/resolv.conf* to include a line on the very top with your traffic analysis host (e.g add "nameserver 127.0.0.1"  if you are running locally). Alternatively, you can add a DNS server address using tools such as Network Manager. Inside the Network Manager open IPv4 Settings, select *Automatic (DHCP) addresses only* or *Manual* from the *Method* drop down box and edit *DNS Servers* text box to include an IP address with DNSChef running.

- **Windows** - Select *Network Connections* from the *Control Panel*. Next select one of the connections (e.g. "Local Area Connection"), right-click on it and select properties. From within a newly appearing dialog box, select *Internet Protocol (TCP/IP)* and click on properties. At last select *Use the following DNS server addresses* radio button and enter the IP address with DNSChef running. For example, if running locally enter 127.0.0.1.

- **OS X** - Open *System Preferences* and click on the *Network* icon. Select the active interface and fill in the *DNS Server* field. If you are using Airport then you will have to click on *Advanced...* button and edit DNS servers from there. Alternatively, you can edit */etc/resolv.conf* and add a fake nameserver to the very top there (e.g "nameserver 127.0.0.1").

- **iOS** - Open *Settings* and select *General*. Next select on *Wi-Fi* and click on a blue arrow to the right of an active Access Point from the list. Edit DNS entry to point to the host with DNSChef running. Make sure you have disabled Cellular interface (if available).

- **Android** - Open *Settings* and select *Wireless and network*.  Click on *Wi-Fi settings* and select *Advanced* after pressing the *Options* button on the phone. Enable *Use static IP* checkbox and configure a custom DNS server.

If you do not have the ability to modify device's DNS settings manually, then you still have several options involving techniques such as [ARP Spoofing](http://en.wikipedia.org/wiki/ARP_spoofing), [Rogue DHCP](http://www.yersinia.net/doc.htm) and other creative methods.

At last you need to configure a fake service where DNSChef will point all of the requests. For example, if you are trying to intercept web traffic, you must bring up either a separate web server running on port 80 or set up a web proxy (e.g. Burp) to intercept traffic. DNSChef will point queries to your proxy/server host with properly configured services.

## Running DNSChef

DNSChef is a cross-platform application developed in Python which should run on most platforms which have a Python interpreter. This guide will concentrate on Unix environments; however, all of the examples below were tested to work on Windows as well.

Let's get a taste of DNSChef with its most basic monitoring functionality. Execute the following command as root (required to start a server on port 53):

    # ./dnschef.py
        
              _                _          __  
             | | version 0.2  | |        / _| 
           __| |_ __  ___  ___| |__   ___| |_ 
          / _` | '_ \/ __|/ __| '_ \ / _ \  _|
         | (_| | | | \__ \ (__| | | |  __/ |  
          \__,_|_| |_|___/\___|_| |_|\___|_|  
                       [email protected]  

    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 8.8.8.8
    [*] No parameters were specified. Running in full proxy mode

Without any parameters, DNSChef will run in full proxy mode. This means that all requests will simply be forwarded to an upstream DNS server (8.8.8.8 by default) and returned back to the quering host. For example, let's query an "A" record for a domain and observe results:

    $ host -t A thesprawl.org
    thesprawl.org has address 108.59.3.64

DNSChef will print the following log line showing time, source IP address, type of record requested and most importantly which name was queried:

    [23:54:03] 127.0.0.1: proxying the response of type 'A' for thesprawl.org

This mode is useful for simple application monitoring where you need to figure out which domains it uses for its communications.

DNSChef has full support for IPv6 which can be activated using *-6* or *--ipv6** flags. It works exactly as IPv4 mode with the exception that default listening interface is switched to ::1 and default DNS server is switched to 2001:4860:4860::8888. Here is a sample output:

    # ./dnschef.py -6
              _                _          __
             | | version 0.2  | |        / _|
           __| |_ __  ___  ___| |__   ___| |_
          / _` | '_ \/ __|/ __| '_ \ / _ \  _|
         | (_| | | | \__ \ (__| | | |  __/ |
          \__,_|_| |_|___/\___|_| |_|\___|_|
                       [email protected]

    [*] Using IPv6 mode.
    [*] DNSChef started on interface: ::1
    [*] Using the following nameservers: 2001:4860:4860::8888
    [*] No parameters were specified. Running in full proxy mode
    [00:35:44] ::1: proxying the response of type 'A' for thesprawl.org
    [00:35:44] ::1: proxying the response of type 'AAAA' for thesprawl.org
    [00:35:44] ::1: proxying the response of type 'MX' for thesprawl.org

NOTE: By default, DNSChef creates a UDP listener. You can use TCP instead with the *--tcp* argument discussed later.

## Running the DNSChef HTTP API

> [!WARNING]
> The API has no authentication. Allow/deny access at the network level through security groups, iptables, firewall etc..

`uvicorn dnschef.api:app`

You can then view the OpenAPI documentation at `http://127.0.0.1:8000/docs````
$ uvicorn dnschef.api:app
INFO:     Started server process [28327]
INFO:     Waiting for application startup.
          _                _          __  
         | | version 0.6.0  | |        / _| 
       __| |_ __  ___  ___| |__   ___| |_ 
      / _` | '_ \/ __|/ __| '_ \ / _ \  _|
     | (_| | | | \__ \ (__| | | |  __/ |  
      \__,_|_| |_|___/\___|_| |_|\___|_|  
                @iphelix // @byt3bl33d3r  

2023-09-28 11:24:59 cooking replies                domain=*.thesprawl.org record=192.0.2.1 section=A
2023-09-28 11:24:59 cooking replies                domain=*.thesprawl.org record=2001:db8::1 section=AAAA
-- SNIP --
2023-09-28 11:24:59 cooking replies                domain=*.thesprawl.org record=1 . alpn=h2 ipv4hint=127.0.0.1 ipv6hint=::1 section=HTTPS
INFO:     Application startup complete.
2023-09-28 11:24:59 DNSChef is active              interface=127.0.0.1 ipv6=False nameservers=['8.8.8.8'] port=53 tcp=False
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)

# ./dnschef.py --fakeip 127.0.0.1 -q
[*] DNSChef started on interface: 127.0.0.1 
[*] Using the following nameservers: 8.8.8.8
[*] Cooking all A replies to point to 127.0.0.1
[23:55:57] 127.0.0.1: cooking the response of type 'A' for google.com to 127.0.0.1
[23:55:57] 127.0.0.1: proxying the response of type 'AAAA' for google.com
[23:55:57] 127.0.0.1: proxying the response of type 'MX' for google.com

$ host google.com localhost
google.com has address 127.0.0.1
google.com has IPv6 address 2001:4860:4001:803::1001
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

# ./dnschef.py --fakeip 127.0.0.1 --fakeipv6 ::1 -q
[*] DNSChef started on interface: 127.0.0.1 
[*] Using the following nameservers: 8.8.8.8
[*] Cooking all A replies to point to 127.0.0.1
[*] Cooking all AAAA replies to point to ::1
[00:02:14] 127.0.0.1: cooking the response of type 'A' for google.com to 127.0.0.1
[00:02:14] 127.0.0.1: cooking the response of type 'AAAA' for google.com to ::1
[00:02:14] 127.0.0.1: proxying the response of type 'MX' for google.com

$ host google.com localhost
google.com has address 127.0.0.1
google.com has IPv6 address ::1
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

# ./dnschef.py --fakeip 127.0.0.1 --fakeipv6 ::1 --fakemail mail.fake.com --fakealias www.fake.com --fakens ns.fake.com -q
[*] DNSChef started on interface: 127.0.0.1 
[*] Using the following nameservers: 8.8.8.8
[*] Cooking all A replies to point to 127.0.0.1
[*] Cooking all AAAA replies to point to ::1
[*] Cooking all MX replies to point to mail.fake.com
[*] Cooking all CNAME replies to point to www.fake.com
[*] Cooking all NS replies to point to ns.fake.com
[00:17:29] 127.0.0.1: cooking the response of type 'ANY' for google.com with all known fake records.

# host -t ANY google.com localhost
google.com has address 127.0.0.1
google.com has IPv6 address ::1
google.com mail is handled by 10 mail.fake.com.
google.com is an alias for www.fake.com.
google.com name server ns.fake.com.

# ./dnschef.py --fakeip 127.0.0.1 --fakedomains thesprawl.org -q
[*] DNSChef started on interface: 127.0.0.1
[*] Using the following nameservers: 8.8.8.8  
[*] Cooking replies to point to 127.0.0.1 matching: thesprawl.org
[00:23:37] 127.0.0.1: cooking the response of type 'A' for thesprawl.org to 127.0.0.1
[00:23:52] 127.0.0.1: proxying the response of type 'A' for mx9.webfaction.com

# ./dnschef.py --fakeip 127.0.0.1 --truedomains thesprawl.org,*.webfaction.com -q
[*] DNSChef started on interface: 127.0.0.1
[*] Using the following nameservers: 8.8.8.8  
[*] Cooking replies to point to 127.0.0.1 not matching: *.webfaction.com, thesprawl.org
[00:27:57] 127.0.0.1: proxying the response of type 'A' for mx9.webfaction.com
[00:28:05] 127.0.0.1: cooking the response of type 'A' for google.com to 127.0.0.1

`[A]` 섹션 헤더는 DNSChef에 레코드 유형을 정의한다는 점에 주목하세요. 이제 여러 쿼리의 출력을 자세히 살펴보겠습니다:

    # ./dnschef.py --file dnschef.toml -q
    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 8.8.8.8
    [+] Cooking A replies for domain *.google.com with '192.0.2.1'
    [+] Cooking A replies for domain thesprawl.org with '192.0.2.2'
    [+] Cooking A replies for domain *.wordpress.* with '192.0.2.3'
    [00:43:54] 127.0.0.1: cooking the response of type 'A' for google.com to 192.0.2.1
    [00:44:05] 127.0.0.1: cooking the response of type 'A' for www.google.com to 192.0.2.1
    [00:44:19] 127.0.0.1: cooking the response of type 'A' for thesprawl.org to 192.0.2.2
    [00:44:29] 127.0.0.1: proxying the response of type 'A' for www.thesprawl.org
    [00:44:40] 127.0.0.1: cooking the response of type 'A' for www.wordpress.org to 192.0.2.3
    [00:44:51] 127.0.0.1: cooking the response of type 'A' for wordpress.com to 192.0.2.3
    [00:45:02] 127.0.0.1: proxying the response of type 'A' for slashdot.org

*google.com*과 *www.google.com* 모두 *\*.google.com* 항목과 일치하여 *192.0.2.1*로 올바르게 확인되었습니다. 반면 *www.thesprawl.org* 요청은 수정되지 않고 단순히 프록시 처리되었습니다. 마지막으로 *wordpress.com*, *www.wordpress.org* 등의 모든 변형이 *\*.wordpress.\** 마스크와 일치하여 *192.0.2.3*으로 올바르게 확인되었습니다. 마지막으로 정의되지 않은 *slashdot.org* 쿼리는 실제 응답으로 단순히 프록시 처리되었습니다.

명령줄에 명시적으로 노출되지 않은 레코드 유형을 포함한 다른 모든 지원 DNS 레코드 유형에 대해 섹션 헤더를 지정할 수 있습니다: [A], [AAAA], [MX], [NS], [CNAME], [PTR], [NAPTR], [SOA]. 예를 들어 `dnschef.toml` 파일에 새 [PTR] 섹션을 정의해 보겠습니다:```toml
[PTR]
"*.2.0.192.in-addr.arpa"="fake.com"

 ./dnschef.py --file dnschef.toml -q
[sudo] password for iphelix: 
[*] DNSChef started on interface: 127.0.0.1 
[*] Using the following nameservers: 8.8.8.8
[+] Cooking PTR replies for domain *.2.0.192.in-addr.arpa with 'fake.com'
[00:11:34] 127.0.0.1: cooking the response of type 'PTR' for 1.2.0.192.in-addr.arpa to fake.com

$ host 192.0.2.1 localhost
1.2.0.192.in-addr.arpa domain name pointer fake.com.

./dnschef.py --file dnschef.toml -q
[sudo] password for iphelix: 
[*] DNSChef started on interface: 127.0.0.1 
[*] Using the following nameservers: 8.8.8.8
[+] Cooking PTR replies for domain *.2.0.192.in-addr.arpa with 'fake.com'
[00:11:34] 127.0.0.1: cooking the response of type 'PTR' for 1.2.0.192.in-addr.arpa to fake.com

$ host 192.0.2.1 localhost
1.2.0.192.in-addr.arpa domain name pointer fake.com.

See sample `dnschef.toml` file for additional examples.

## 파일 스테이징

DNSChef는 DNS를 통해 모든 파일을 "스테이징"할 수 있습니다. 현재 파일 스테이징은 `A`, `AAAA` 및 `TXT` 레코드만 지원됩니다(더 추가 예정). DNSChef에 파일 스테이징을 지시하려면 `dnschef.toml`에 다음 섹션을 추가하세요:```toml
[A]
"*.wat.org" = { file = "/home/payload.exe", chunk_size = 4 }

[AAAA]
"*.gorgetowngeronimos.org" = { file = "/home/payload.exe", chunk_size = 16 }

이 구성에서 `ns*.dungbeetle.org`에 대한 모든 `TXT` 쿼리는 로컬 파일시스템의 `~/payload.exe`에 위치한 파일 청크를 반환합니다.

`response_format` 및 `response_prefix_pool` 설정은 선택 사항이지만 DNS `TXT` 응답을 추가로 사용자 지정할 수 있게 해줍니다.

`response_format` 설정은 `TXT` 응답의 형식을 정의합니다:

- `{prefix}` 변수는 `response_prefix_pool` 배열에 정의된 값 중 하나로 무작위 대체됩니다.

- `{chunk}` 변수는 파일 청크로 대체됩니다.

위 구성에서 `ns1.dungbeetle.org`에 대한 `TXT` 쿼리는 다음 응답을 반환합니다:```
docusign=test-<BASE64_ENCODED_FILE_CHUNK_N1>

## 고급 필터링

파일과 명령줄에서 입력을 혼합하여 사용할 수 있습니다. 예를 들어 다음 명령은 `--file`과 `--fakedomains` 매개변수를 모두 사용합니다:

    # ./dnschef.py --file dnschef.toml --fakeip 6.6.6.6 --fakedomains=thesprawl.org,slashdot.org -q
    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 8.8.8.8
    [+] Cooking A replies for domain *.google.com with '192.0.2.1'
    [+] Cooking A replies for domain thesprawl.org with '192.0.2.2'
    [+] Cooking A replies for domain *.wordpress.* with '192.0.2.3'
    [*] Cooking A replies to point to 6.6.6.6 matching: *.wordpress.*, *.google.com, thesprawl.org
    [*] Cooking A replies to point to 6.6.6.6 matching: slashdot.org, *.wordpress.*, *.google.com, thesprawl.org
    [00:49:05] 127.0.0.1: cooking the response of type 'A' for google.com to 192.0.2.1
    [00:49:15] 127.0.0.1: cooking the response of type 'A' for slashdot.org to 6.6.6.6
    [00:49:31] 127.0.0.1: cooking the response of type 'A' for thesprawl.org to 6.6.6.6
    [00:50:08] 127.0.0.1: proxying the response of type 'A' for tor.com

명령줄 매개변수의 *thesprawl.org* 정의가 *dnschef.toml*의 정의보다 우선했음을 확인할 수 있습니다. 이는 구성 파일의 값을 재정의하려는 경우 유용할 수 있습니다. slashdot.org는 *--fakedomains* 매개변수에 지정되었으므로 여전히 가짜 IP 주소로 확인됩니다. tor.com 요청은 명령줄이나 구성 파일 어디에도 지정되지 않았으므로 단순히 프록시 처리됩니다.

## 기타 구성

보안상의 이유로 DNSChef는 기본적으로 로컬 127.0.0.1(IPv6의 경우 ::1) 인터페이스에서 수신 대기합니다. *--interface* 매개변수를 사용하여 DNSChef가 다른 인터페이스에서 수신 대기하도록 할 수 있습니다:

    # ./dnschef.py --interface 0.0.0.0 -q
    [*] DNSChef started on interface: 0.0.0.0
    [*] Using the following nameservers: 8.8.8.8 
    [*] No parameters were specified. Running in full proxy mode
    [00:50:53] 192.0.2.105: proxying the response of type 'A' for thesprawl.org

또는 IPv6의 경우:

    # ./dnschef.py -6 --interface :: -q
    [*] Using IPv6 mode.
    [*] DNSChef started on interface: ::
    [*] Using the following nameservers: 2001:4860:4860::8888
    [*] No parameters were specified. Running in full proxy mode
    [00:57:46] 2001:db8::105: proxying the response of type 'A' for thesprawl.org

기본적으로 DNSChef는 프록시 요청을 위해 Google의 공개 DNS 서버를 사용합니다. 하지만 *--nameservers* 매개변수를 사용하여 사용자 정의 네임서버 목록을 정의할 수 있습니다:

    # ./dnschef.py --nameservers 4.2.2.1,4.2.2.2 -q
    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 4.2.2.1, 4.2.2.2
    [*] No parameters were specified. Running in full proxy mode
    [00:55:08] 127.0.0.1: proxying the response of type 'A' for thesprawl.org

IP#PORT 표기법을 사용하여 비표준 네임서버 포트를 지정할 수 있습니다:

    # ./dnschef.py --nameservers 192.0.2.2#5353 -q
    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 192.0.2.2#5353
    [*] No parameters were specified. Running in full proxy mode
    [02:03:12] 127.0.0.1: proxying the response of type 'A' for thesprawl.org

동시에 `-p port#` 매개변수를 사용하여 DNSChef 자체를 대체 포트에서 시작할 수도 있습니다:

    # ./dnschef.py -p 5353 -q
    [*] Listening on an alternative port 5353
    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 8.8.8.8
    [*] No parameters were specified. Running in full proxy mode

DNS 프로토콜은 UDP(기본값) 또는 TCP를 통해 사용할 수 있습니다. DNSChef는 `--tcp` 플래그로 활성화할 수 있는 TCP 모드를 구현합니다.