new: net.sniff now will parse and print mDNS query responses

This commit is contained in:
evilsocket 2018-08-30 12:30:08 +03:00
parent 3034220f55
commit 00c32c2cc6
No known key found for this signature in database
GPG key ID: 1564D7F30393A456
2 changed files with 62 additions and 0 deletions

60
modules/net_sniff_mdns.go Normal file
View file

@ -0,0 +1,60 @@
package modules
import (
"strings"
"github.com/bettercap/bettercap/core"
"github.com/bettercap/bettercap/packets"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/miekg/dns"
)
func mdnsParser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
if udp.SrcPort == packets.MDNSPort && udp.DstPort == packets.MDNSPort {
var msg dns.Msg
if err := msg.Unpack(udp.Payload); err == nil && msg.Opcode == dns.OpcodeQuery && len(msg.Answer) > 0 {
m := make(map[string][]string)
for _, answer := range append(msg.Answer, msg.Extra...) {
switch rr := answer.(type) {
case *dns.A:
name := rr.Header().Name
if _, found := m[name]; found == false {
m[name] = make([]string, 0)
}
m[name] = append(m[name], answer.(*dns.A).A.String())
case *dns.AAAA:
name := rr.Header().Name
if _, found := m[name]; found == false {
m[name] = make([]string, 0)
}
m[name] = append(m[name], answer.(*dns.AAAA).AAAA.String())
}
}
for hostname, ips := range m {
NewSnifferEvent(
pkt.Metadata().Timestamp,
"mdns",
ip.SrcIP.String(),
ip.DstIP.String(),
nil,
"%s %s : %s is %s",
core.W(core.BG_DGRAY+core.FG_WHITE, "mdns"),
vIP(ip.SrcIP),
core.Yellow(hostname),
core.Dim(strings.Join(ips, ", ")),
).Push()
}
return true
}
}
return false
}

View file

@ -45,6 +45,8 @@ func udpParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
if dnsParser(ip, pkt, udp) {
return
} else if mdnsParser(ip, pkt, udp) {
return
} else if krb5Parser(ip, pkt, udp) {
return
} else if verbose {