From 1f37381fde4c717010b2fd5f63df189c0f52a0c2 Mon Sep 17 00:00:00 2001
From: evilsocket <evilsocket@gmail.com>
Date: Thu, 4 Apr 2019 10:01:49 +0200
Subject: [PATCH] fix: when net.sniff is sniffing a mDNS hostname, it'll update
 the endpoint field

---
 modules/net_sniff/net_sniff.go      | 2 ++
 modules/net_sniff/net_sniff_mdns.go | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/modules/net_sniff/net_sniff.go b/modules/net_sniff/net_sniff.go
index d97780c2..44079e05 100644
--- a/modules/net_sniff/net_sniff.go
+++ b/modules/net_sniff/net_sniff.go
@@ -29,6 +29,8 @@ func NewSniffer(s *session.Session) *Sniffer {
 		Stats:         nil,
 	}
 
+	mod.SessionModule.Requires("net.recon")
+
 	mod.AddParam(session.NewBoolParameter("net.sniff.verbose",
 		"false",
 		"If true, every captured and parsed packet will be sent to the events.stream for displaying, otherwise only the ones parsed at the application layer (sni, http, etc)."))
diff --git a/modules/net_sniff/net_sniff_mdns.go b/modules/net_sniff/net_sniff_mdns.go
index 7678b073..f2bbe408 100644
--- a/modules/net_sniff/net_sniff_mdns.go
+++ b/modules/net_sniff/net_sniff_mdns.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/bettercap/bettercap/packets"
+	"github.com/bettercap/bettercap/session"
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
@@ -44,6 +45,14 @@ func mdnsParser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
 			}
 
 			for hostname, ips := range m {
+				for _, ip := range ips {
+					if endpoint := session.I.Lan.GetByIp(ip); endpoint != nil {
+						endpoint.OnMeta(map[string]string{
+							"mdns:hostname": hostname,
+						})
+					}
+				}
+
 				NewSnifferEvent(
 					pkt.Metadata().Timestamp,
 					"mdns",