[!NOTE] 이것은 @iphelix가 원래 작성한 DNSChef의 업데이트된 버전입니다.``` _ _ __
| | v0.7 | | / |
| | __ ___ | | | | ______ _ __ __ _ / | '_ \/ __|/ __| '_ \ / _ \ _|______| '_ \ / _ | | (| | | | _ \ (__| | | | __/ | | | | | (| | _,|| ||/_|| ||___|| || ||_, | / | |_/ D O C U M E N T A T I O N
DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy (aka "Fake DNS") is a tool used for application network traffic analysis among other uses. For example, a DNS proxy can be used to fake requests for "badguy.com" to point to a local machine for termination or interception instead of a real host somewhere on the Internet. 

There are several DNS Proxies out there. Most will simply point all DNS queries a single IP address or implement only rudimentary filtering. DNSChef was developed as part of a penetration test where there was a need for a more configurable system. As a result, DNSChef is cross-platform application capable of forging responses based on inclusive and exclusive domain lists, supporting multiple DNS record types, matching domains with wildcards, proxying true responses for nonmatching domains, defining external configuration files, IPv6 and many other features. You can find detailed explanation of each of the features and suggested uses below.

The use of DNS Proxy is recommended in situations where it is not possible to force an application to use some other proxy server directly. For example, some mobile applications completely ignore OS HTTP Proxy settings. In these cases, the use of a DNS proxy server such as DNSChef will allow you to trick that application into forwarding connections to the desired destination.

## New Features 

- Requires Python 3.11+
- Supports staging files over DNS (only over `A`,`AAAA`,`TXT` for now...)
- Config file is now TOML
- Optional HTTP API (allows you to query logs and update config remotely)
- Fully async for increased performance (uses AsyncIO)
- Structured logging and a number of QOL improvements
- Is now a Python package
- Dockerized
- Includes a number of the PRs and fixes from the original repo

## Installing

To install the latest release you should use [pipx](https://pypa.github.io/pipx/) (unless you're a piece of shit who enjoys sloppy stakes):

    pipx install dnschef-ng

If you want the HTTP API (requires some extra dependencies):
    
    pipx install dnschef-ng[api]

Install latest version from Git using pipx:

     pipx install git+https://github.com/byt3bl33d3r/dnschef-ng.git

Install latest version from Git using pipx with the deps for the HTTP API:

     pipx install "git+https://github.com/byt3bl33d3r/dnschef-ng.git#egg=dnschef-ng[api]"


## Setting up a DNS Proxy

Before you can start using DNSChef, you must configure your machine to use a DNS nameserver with the tool running on it. You have several options based on the operating system you are going to use:

- **Linux** - Edit */etc/resolv.conf* to include a line on the very top with your traffic analysis host (e.g add "nameserver 127.0.0.1"  if you are running locally). Alternatively, you can add a DNS server address using tools such as Network Manager. Inside the Network Manager open IPv4 Settings, select *Automatic (DHCP) addresses only* or *Manual* from the *Method* drop down box and edit *DNS Servers* text box to include an IP address with DNSChef running.

- **Windows** - Select *Network Connections* from the *Control Panel*. Next select one of the connections (e.g. "Local Area Connection"), right-click on it and select properties. From within a newly appearing dialog box, select *Internet Protocol (TCP/IP)* and click on properties. At last select *Use the following DNS server addresses* radio button and enter the IP address with DNSChef running. For example, if running locally enter 127.0.0.1.

- **OS X** - Open *System Preferences* and click on the *Network* icon. Select the active interface and fill in the *DNS Server* field. If you are using Airport then you will have to click on *Advanced...* button and edit DNS servers from there. Alternatively, you can edit */etc/resolv.conf* and add a fake nameserver to the very top there (e.g "nameserver 127.0.0.1").

- **iOS** - Open *Settings* and select *General*. Next select on *Wi-Fi* and click on a blue arrow to the right of an active Access Point from the list. Edit DNS entry to point to the host with DNSChef running. Make sure you have disabled Cellular interface (if available).

- **Android** - Open *Settings* and select *Wireless and network*.  Click on *Wi-Fi settings* and select *Advanced* after pressing the *Options* button on the phone. Enable *Use static IP* checkbox and configure a custom DNS server.

If you do not have the ability to modify device's DNS settings manually, then you still have several options involving techniques such as [ARP Spoofing](http://en.wikipedia.org/wiki/ARP_spoofing), [Rogue DHCP](http://www.yersinia.net/doc.htm) and other creative methods.

At last you need to configure a fake service where DNSChef will point all of the requests. For example, if you are trying to intercept web traffic, you must bring up either a separate web server running on port 80 or set up a web proxy (e.g. Burp) to intercept traffic. DNSChef will point queries to your proxy/server host with properly configured services.

## Running DNSChef

DNSChef is a cross-platform application developed in Python which should run on most platforms which have a Python interpreter. This guide will concentrate on Unix environments; however, all of the examples below were tested to work on Windows as well.

Let's get a taste of DNSChef with its most basic monitoring functionality. Execute the following command as root (required to start a server on port 53):

    # ./dnschef.py
        
              _                _          __  
             | | version 0.2  | |        / _| 
           __| |_ __  ___  ___| |__   ___| |_ 
          / _` | '_ \/ __|/ __| '_ \ / _ \  _|
         | (_| | | | \__ \ (__| | | |  __/ |  
          \__,_|_| |_|___/\___|_| |_|\___|_|  
                       [email protected]  

    [*] DNSChef started on interface: 127.0.0.1 
    [*] Using the following nameservers: 8.8.8.8
    [*] No parameters were specified. Running in full proxy mode

Without any parameters, DNSChef will run in full proxy mode. This means that all requests will simply be forwarded to an upstream DNS server (8.8.8.8 by default) and returned back to the quering host. For example, let's query an "A" record for a domain and observe results:

    $ host -t A thesprawl.org
    thesprawl.org has address 108.59.3.64

DNSChef will print the following log line showing time, source IP address, type of record requested and most importantly which name was queried:

    [23:54:03] 127.0.0.1: proxying the response of type 'A' for thesprawl.org

This mode is useful for simple application monitoring where you need to figure out which domains it uses for its communications.

DNSChef has full support for IPv6 which can be activated using *-6* or *--ipv6** flags. It works exactly as IPv4 mode with the exception that default listening interface is switched to ::1 and default DNS server is switched to 2001:4860:4860::8888. Here is a sample output:

    # ./dnschef.py -6
              _                _          __
             | | version 0.2  | |        / _|
           __| |_ __  ___  ___| |__   ___| |_
          / _` | '_ \/ __|/ __| '_ \ / _ \  _|
         | (_| | | | \__ \ (__| | | |  __/ |
          \__,_|_| |_|___/\___|_| |_|\___|_|
                       [email protected]
dnschef-ng

인기
