A5: DNS Monitoring with Python (35 pts)

What You Need

A Kali Linux machine, real or virtual. You could use Windows with Python installed, but it's easier to just use Linux.

Purpose

Monitor DNS and deobfuscate data exfiltrated via DNS tunneling.

Understanding DNS

Open Wireshark, start sniffing, and filter for

dns

Then, in a Web browser, open a site you haven't recently visited, such as

http://kittenwar.com

You see a DNS request and response, as shown below.

Every time you visit a site, your operating system send a DNS request for the domain without encryption, unless you are using a good VPN or an encrypted DNS protocol like DoH.

This is bad for privacy, but very convenient for network security monitors. If you want to know what your staff are doing, just monitor the DNS traffic and you'll easily who went where, and when.

Monitoring DNS with Python

On Kali, open a text file named dnsmon1.py and paste in this script:

from scapy.all import *

def findDNS(p):
  if p.haslayer(DNS):
    print p.summary()
    print p.display()

sniff(prn=findDNS)

Run the script. In Kali, open Firefox and open a Web page.

Many pages of data scroll by as the page loads, as shown below.

This is too much data--it's too messy.

Monitoring DNS more Efficiently

On Kali, open a text file named dnsmon2.py and paste in this script:

from scapy.all import *

def findDNS(p):
  if p.haslayer(DNS):
    print p[IP].src, p[DNS].summary()

sniff(prn=findDNS)

Run the script. In Kali, open Firefox and open a Web page.

The output is much cleaner now, as shown below.

Viewing Random DNS Calls

In Kali, in Firefox, go to:

http://target1.bowneconsulting.com/php/randomdomain.php

The page makes several calls to the server with different subdomains, as shown below.

You may need to refresh the page a few times to see different domain names.

Malware frequently uses long, random-looking domain names, either to reach command-and-control servers or to exfiltrate stolen data.

A5.1: Challenge: Find the Flag (5 pts)

Open this page:

http://target1.bowneconsulting.com/php/dnschal1.php

Refresh the page a few times. Monitor DNS and find the flag.

A5.2: Challenge: Find the Flag (10 pts)

Open this page:

http://target1.bowneconsulting.com/php/dnschal2.php

Refresh the page a few times. Monitor DNS and find the flag.

A5.3: Challenge: Find the Flag (20 pts)

Open this page:

http://target1.bowneconsulting.com/php/dnschal3.php

Refresh the page a few times. Monitor DNS and find the flag.

References

Scapy Sniffing with Custom Actions, Part 1

Posted: 4-2-19

Links changed to http:// 4-7-19
Hint #2 added 4-14-19
Revised for WCIL 5-20-19