iphelix/dnschef

DNSChef - DNS proxy for Penetration Testers and Malware Analysts

dnschef's Issues

dnslib.dns.DNSError: QTYPE: Invalid forward lookup: [65]

----------------------------------------
Exception happened during processing of request from ('192.168.137.81', 61732)
(19:19:06) [*] 192.168.137.81: cooking the response of type 'A' for gsp85-ssl.ls.apple.com to 192.168.137.1
(19:19:06) [*] 192.168.137.81: cooking the response of type 'A' for clients4.google.com to 192.168.137.1
(19:19:06) [*] 192.168.137.81: cooking the response of type 'A' for www.google.com to 192.168.137.1
Traceback (most recent call last):
  File "C:\Users\oheal\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\LocalCache\local-packages\Python38\site-packages\dnslib\bimap.py", line 66, in __getitem__
    return self.forward[k]
KeyError: 65

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
(19:19:06) [*] 192.168.137.81: cooking the response of type 'A' for www.apple.com to 192.168.137.1
Traceback (most recent call last):
  File "C:\Users\oheal\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\LocalCache\local-packages\Python38\site-packages\dnslib\bimap.py", line 66, in __getitem__
    return self.forward[k]
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1520.0_x64__qbz5n2kfra8p0\lib\socketserver.py", line 650, in process_request_thread
    self.finish_request(request, client_address)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1520.0_x64__qbz5n2kfra8p0\lib\socketserver.py", line 360, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1520.0_x64__qbz5n2kfra8p0\lib\socketserver.py", line 720, in __init__
    self.handle()
KeyError: 65
  File "dnschef.py", line 356, in handle
    response = self.parse(data)
  File "dnschef.py", line 110, in parse
    qtype = QTYPE[d.q.qtype]

How would I fix this? My command line arguments are:
python dnschef.py --fakeip 192.168.137.1 --interface 192.168.137.1 --nameservers 192.168.137.1 -q

[Errno 98] Address already in use

[] DNSChef started on interface: 127.0.0.1
[] Using the following nameservers: 8.8.8.8
[*] No parameters were specified. Running in full proxy mode
[!] Failed to open log file for writing.

after changing line 415 to: except IOError, e:

I found that the error actually had nothing to do with the log file:
[Errno 98] Address already in use

Failed to open log file for writing,

root@scw-8bceb9:~/down/dnschef# ./dnschef.py -i 10.1.20.92 --fakeip xx.xx.xx.xx --logfile=1 _ _ __ | | version 0.3 | | / _| __| |_ __ ___ ___| |__ ___| |_ / _ | '_ / |/ | ' \ / _ \ |
| (| | | | _ \ (| | | | / |
_,|| ||/_|| ||__|_|
[email protected]

[] DNSChef started on interface: 10.1.20.92
[] Using the following nameservers: 8.8.8.8
[*] Cooking all A replies to point to xx.xx.xx.xx
[!] Failed to open log file for writing.
`

first time using this python script everything work great. BUT when restarting my server i receive this error

the log file show this [08/Feb/2017:14:01:48 +0000] DNSChef is active.

i tried to remove the dnschef folder and download it from the beging i am receiving the same error.

Question: filter or reject unwanted query

I have been receiving recursive queries from projects like https://dnsscan.shadowserver.org/. Would it be possible to only response to dns queries coming from a list of originating ip?

Unexpected Error:

Exception happened during processing of request from ('10.0.0.3', 5172) Traceback (most recent call last): File "/usr/lib/python2.7/SocketServer.py", line 596, in process_request_thread self.finish_request(request, client_address) File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request self.RequestHandlerClass(request, client_address, self) File "/usr/lib/python2.7/SocketServer.py", line 652, in __init__ self.handle() File "dnschef.py", line 329, in handle response = self.parse(data) File "dnschef.py", line 101, in parse response.add_answer(RR(qname, getattr(QTYPE,qtype), rdata=RDMAP[qtype](ipv6_hex_tuple))) File "/usr/local/lib/python2.7/dist-packages/dnslib/dns.py", line 1184, in __init__ self.data = tuple(data) File "/usr/local/lib/python2.7/dist-packages/dnslib/ranges.py", line 124, in setter (attr,n,val)) ValueError: Attribute 'data' must be tuple with 16 elements [(10, 0, 0, 2)]

Syntax Errors

log.error(f"{self.client_address[0]}: ERROR: invalid DNS request")
^
SyntaxError: invalid syntax

Seeking to update DNSChef.exe from version 0.3 to version 0.4.6.2

Hi
I am using DNSChef 0.3 on windows (dnschef.exe) which I found on the internet (compiled by someone else),
it has been working fine till now.
I recently started getting an error (see below) most likely related to dependency on lib-files out of date.
Could someone connected with this tool 'DNSCHEF' get in touch so I can explain further ...
I am looking to compile the updated script (dnschef.py version 0.4.6.2) for windows .. as a standalone *.exe.
Waiting for your assistance
Thanks – RON
ERROR:

Exception happened during processing of request from ('127.0.0.1', 50699)
Traceback (most recent call last):
File "SocketServer.pyc", line 593, in process_request_thread
File "SocketServer.pyc", line 334, in finish_request
File "SocketServer.pyc", line 649, in init
File "dnschef.py", line 329, in handle
File "dnschef.py", line 76, in parse
File "dnslib\bimap.pyc", line 68, in getitem
DNSError: QTYPE: Invalid forward lookup: [65]

Can't run dnschef.py

root@kali:~/Desktop/dnschef-master# ./dnschef.py
Traceback (most recent call last):
File "./dnschef.py", line 40, in
from dnslib import *
ModuleNotFoundError: No module named 'dnslib'

Error using ngrok to defeat hostname verification

Got a stack trace, and I'm not sure even how to describe it. These are the steps I took to set up dnschef and the various processes:

Set up nginx on port 443 with a target hostname:

worker_processes  1;
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen       443;
        server_name  www.howsmyssl.com;

        location / {
            root   html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

Run nginx:

sudo /usr/local/bin/nginx -c /usr/local/etc/nginx/nginx.conf

Download and set up ngrok:

wget https://dl.ngrok.com/darwin_amd64/ngrok.zip
unzip ngrok.zip
ngrok 443

ngrok should show you two lines:

Forwarding                    http://1d775921.ngrok.com -> 127.0.0.1:80
Forwarding                    https://1d775921.ngrok.com -> 127.0.0.1:80

Check to see that ngrok is proxying to nginx, and is providing the HTTPS certificates:

curl https://1d775921.ngrok.com | grep "Welcome to nginx"
<title>Welcome to nginx!</title>
<h1>Welcome to nginx!</h1>

➜  ~  host 1d775921.ngrok.com
1d775921.ngrok.com has address 173.255.204.192

Download dnschef:

sudo - su
curl -O https://thesprawl.org/media/projects/dnschef-0.2.1.tar.gz
tar xvzf dnschef-0.2.1.tar.gz
cd dnschef-0.2.1
/usr/local/bin/python ./dnschef.py --fakedomains www.howsmyssl.com --fakeip 173.255.204.192

Now hit www.howsmyssl.com using -k to suppress hostname validation:

curl -k https://www.howsmyssl.com

[*] Cooking A replies to point to 1d775921.ngrok.com matching: www.howsmyssl.com
[15:21:48] 127.0.0.1: proxying the response of type 'AAAA' for v2-api-1998245248.us-east-1.elb.amazonaws.com
[15:21:49] 127.0.0.1: cooking the response of type 'A' for www.howsmyssl.com to 1d775921.ngrok.com
----------------------------------------
Exception happened during processing of request from ('127.0.0.1', 51320)
Traceback (most recent call last):
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 593, in process_request_thread
    self.finish_request(request, client_address)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 334, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 649, in __init__
    self.handle()
  File "./dnschef.py", line 212, in handle
    response = self.parse(data)
  File "./dnschef.py", line 110, in parse
    response = response.pack()
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 238, in pack
    rr.pack(buffer)
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 463, in pack
    self.rdata.pack(buffer)
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 516, in pack
    buffer.pack("!BBBB",*map(int,self.data.split(".")))
ValueError: invalid literal for int() with base 10: '1d775921'
----------------------------------------
[15:21:49] 127.0.0.1: proxying the response of type 'A' for v2-api-1998245248.us-east-1.elb.amazonaws.com
[15:21:50] 127.0.0.1: cooking the response of type 'A' for www.howsmyssl.com to 1d775921.ngrok.com
----------------------------------------
Exception happened during processing of request from ('127.0.0.1', 51320)
Traceback (most recent call last):
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 593, in process_request_thread
    self.finish_request(request, client_address)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 334, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 649, in __init__
    self.handle()
  File "./dnschef.py", line 212, in handle
    response = self.parse(data)
  File "./dnschef.py", line 110, in parse
    response = response.pack()
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 238, in pack
    rr.pack(buffer)
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 463, in pack
    self.rdata.pack(buffer)
  File "/private/var/root/dnschef-0.2.1/lib/dnslib/dns.py", line 516, in pack
    buffer.pack("!BBBB",*map(int,self.data.split(".")))
ValueError: invalid literal for int() with base 10: '1d775921'
----------------------------------------

"Could not proxy request: timed out" for 99% responses

On the "Rogue DNS" (ubuntu 16.04 ARM)

root@MyServer:/# iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
root@MyServer:/# iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
root@MyServer:/# /opt/scripts/dnschef.py --fakeip 192.168.1.42 --fakedomains *.hello.world.com --interface 192.168.1.42 --nameservers 8.8.4.4 --logfile=/var/log/dnschef.log -q
[*] DNSChef started on interface: 192.168.1.42 
[*] Using the following nameservers: 8.8.4.4
[*] Cooking A replies to point to 192.168.1.90 matching: *.hello.world.com
[00:25:08] 192.168.1.66: proxying the response of type 'A' for www.google.com
[00:25:11] 192.168.1.66: proxying the response of type 'A' for www.google.com
[00:25:12] 192.168.1.66: proxying the response of type 'A' for www.google.com
[00:25:15] 192.168.1.66: proxying the response of type 'A' for www.google.com
[00:26:22] 192.168.1.66: cooking the response of type 'A' for www.hello.world.com to 192.168.1.42
[00:26:25] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
[00:26:30] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
[00:26:37] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
[00:26:42] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
[00:26:48] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
[00:26:53] 192.168.1.66: proxying the response of type 'A' for www.google.com
[!] Could not proxy request: timed out
^C[*] DNSChef is shutting down.

On the client who test the DNS :

user @ machine  ~
└─ $ ▶ host -t A www.google.com 192.168.1.42
Using domain server:
Name: 192.168.1.42
Address: 192.168.1.42#53
Aliases: 

www.google.com has address 172.217.17.68
user @ machine  ~
└─ $ ▶ host -t A www.google.com 192.168.1.42
;; connection timed out; no servers could be reached
user @ machine  ~
└─ $ ▶ host -t A www.hello.world.com 192.168.1.42
Using domain server:
Name: 192.168.1.42
Address: 192.168.1.42#53
Aliases: 

www.hello.world.com has address 192.168.1.42
user @ machine  ~
└─ $ ▶ host -t A www.google.com 192.168.1.42
;; connection timed out; no servers could be reached
user @ machine  ~
└─ $ ▶ host -t A www.google.com 192.168.1.42
;; connection timed out; no servers could be reached

Hmm, this appear when i add the dnschef server in the router's DNS list and enable DNS Relay on it, but their is not any line in dnschef about connexion from the router's ip address.
In iftop i can see the connexion to the google dns server used in this test (8.8.4.4).

-q still give output for everything

It seems -q isn't working for me?

Listen on UDP, proxy over TCP

I have a unique situation where the app I am trying to spoof DNS for can only talk UDP and the upstream proxy server that I want DNSChef to proxy too can only talk TCP. Any chance thats a quick change to be able to do this?

TypeError with --truedomains

Hello, i was testing dnschef on MX Linux 18.2 with Python 3.7.3 and 3.6.8 and both times dnschef responded to requests with a "TypeError: '<' not supported between instances of 'str' and 'bool'".
I started dnschef with the command "sudo python3.6 ./Programme/dnschef.py --fakeip 127.0.0.1 --truedomains ..speedport.ip" and requested with "host google.com localhost". If i omitted --truedomains, the Exceptions did not occur.

If it should be my fault I apologize for it very much, but I would be very grateful for help.

Full Exception: Exception.txt

Does this tool support 0x20 encoding?

When proxying the DNS requests, can this tool send the response using proper 0x20 DNS encoding? Does it do this by default?

I would suggest adding a note about this (whether or not the tool supports it) to the README.

To add support, here is more information:

Scientific Paper: https://sci-hub.se/10.1145/1455770.1455798

Torrent Magnet Link:

magnet:?xt=urn:btih:ec75769f90f1eb1f25ceccd6a8294b9049cb7351&dn=dagon2008.pdf&tr=udp%3a%2f%2fopen.tracker.cl%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=http%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=udp%3a%2f%2f9.rarbg.com%3a2810%2fannounce&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a6969%2fannounce&tr=udp%3a%2f%2fexodus.desync.com%3a6969%2fannounce&tr=http%3a%2f%2ftracker.openbittorrent.com%3a80%2fannounce&tr=http%3a%2f%2fopenbittorrent.com%3a80%2fannounce&tr=udp%3a%2f%2fwww.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2ftracker2.dler.org%3a80%2fannounce&tr=udp%3a%2f%2ftracker.torrent.eu.org%3a451%2fannounce&tr=udp%3a%2f%2ftracker.moeking.me%3a6969%2fannounce&tr=udp%3a%2f%2fretracker.lanta-net.ru%3a2710%2fannounce&tr=udp%3a%2f%2fopen.stealth.si%3a80%2fannounce&tr=udp%3a%2f%2fmts.tvbit.co%3a6969%2fannounce&tr=udp%3a%2f%2finferno.demonoid.is%3a3391%2fannounce&tr=udp%3a%2f%2fbt2.archive.org%3a6969%2fannounce&tr=udp%3a%2f%2fbt1.archive.org%3a6969%2fannounce&tr=udp%3a%2f%2fadmin.videoenpoche.info%3a6969%2fannounce&tr=udp%3a%2f%2f6ahddutb1ucc3cp.ru%3a6969%2fannounce&tr=https%3a%2f%2ftrackme.theom.nz%3a443%2fannounce&tr=https%3a%2f%2ftracker.nanoha.org%3a443%2fannounce&tr=https%3a%2f%2ftracker.lilithraws.cf%3a443%2fannounce&tr=https%3a%2f%2ftracker.iriseden.fr%3a443%2fannounce&tr=http%3a%2f%2fvps02.net.orel.ru%3a80%2fannounce&tr=http%3a%2f%2ftracker.moeking.me%3a6969%2fannounce&tr=http%3a%2f%2ftracker.files.fm%3a6969%2fannounce&tr=http%3a%2f%2ftorrenttracker.nwc.acsalaska.net%3a6969%2fannounce&tr=http%3a%2f%2ft.overflow.biz%3a6969%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=http%3a%2f%2fopen.acgtracker.com%3a1096%2fannounce&tr=http%3a%2f%2ffxtt.ru%3a80%2fannounce&tr=http%3a%2f%2fbt.okmp3.ru%3a2710%2fannounce&tr=udp%3a%2f%2fvibe.sleepyinternetfun.xyz%3a1738%2fannounce&tr=udp%3a%2f%2fudp-tracker.shittyurl.org%3a6969%2fannounce&tr=udp%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=udp%3a%2f%2ftracker1.bt.moack.co.kr%3a80%2fannounce&tr=udp%3a%2f%2ftracker0.ufibox.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.zerobytes.xyz%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.theoks.net%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.swateam.org.uk%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.srv00.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.pomf.se%3a80%2fannounce&tr=udp%3a%2f%2ftracker.ololosh.space%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.monitorit4.me%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.loadbt.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.lelux.fi%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.leech.ie%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.jordan.im%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.filemail.com%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.fatkhoala.org%3a13710%2fannounce&tr=udp%3a%2f%2ftracker.dler.org%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.ddunlimited.net%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.blacksparrowmedia.net%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.bitsearch.to%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.altrosky.nl%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.0x.tf%3a6969%2fannounce&tr=udp%3a%2f%2ftr.cili001.com%3a8070%2fannounce&tr=udp%3a%2f%2fretracker.sevstar.net%3a2710%2fannounce&tr=udp%3a%2f%2fretracker.netbynet.ru%3a2710%2fannounce&tr=udp%3a%2f%2fpublic.tracker.vraphim.com%3a6969%2fannounce&tr=udp%3a%2f%2fpublic.publictracker.xyz%3a6969%2fannounce&tr=udp%3a%2f%2fopentor.org%3a2710%2fannounce&tr=udp%3a%2f%2fopen.publictracker.xyz%3a6969%2fannounce&tr=udp%3a%2f%2fmovies.zsw.ca%3a6969%2fannounce&tr=udp%3a%2f%2fmail.realliferpg.de%3a6969%2fannounce&tr=udp%3a%2f%2ffe.dealclub.de%3a6969%2fannounce&tr=udp%3a%2f%2fexplodie.org%3a6969%2fannounce&tr=udp%3a%2f%2fengplus.ru%3a6969%2fannounce&tr=udp%3a%2f%2fdiscord.heihachi.pw%3a6969%2fannounce&tr=udp%3a%2f%2fcutiegirl.ru%3a6969%2fannounce&tr=udp%3a%2f%2fconcen.org%3a6969%2fannounce&tr=udp%3a%2f%2fcode2chicken.nl%3a6969%2fannounce&tr=udp%3a%2f%2fcamera.lei001.com%3a6969%2fannounce&tr=udp%3a%2f%2fbubu.mapfactor.com%3a6969%2fannounce&tr=udp%3a%2f%2fbt.oiyo.tk%3a6969%2fannounce&tr=udp%3a%2f%2fbclearning.top%3a6969%2fannounce&tr=udp%3a%2f%2fabufinzio.monocul.us%3a6969%2fannounce&tr=https%3a%2f%2ftracker.tamersunion.org%3a443%2fannounce&tr=https%3a%2f%2ftracker.nitrix.me%3a443%2fannounce&tr=https%3a%2f%2ftracker.lelux.fi%3a443%2fannounce&tr=https%3a%2f%2ftracker.kuroy.me%3a443%2fannounce&tr=https%3a%2f%2ftracker.foreverpirates.co%3a443%2fannounce&tr=https%3a%2f%2ftr.torland.ga%3a443%2fannounce&tr=https%3a%2f%2ftr.highstar.shop%3a443%2fannounce&tr=https%3a%2f%2ftr.fuckbitcoin.xyz%3a443%2fannounce&tr=https%3a%2f%2ftr.doogh.club%3a443%2fannounce&tr=https%3a%2f%2ftr.burnabyhighstar.com%3a443%2fannounce&tr=https%3a%2f%2ft.btcland.xyz%3a443%2fannounce&tr=https%3a%2f%2f1337.abcvg.info%3a443%2fannounce&tr=http%3a%2f%2ftrackme.theom.nz%3a80%2fannounce&tr=http%3a%2f%2ftracker4.itzmx.com%3a2710%2fannounce&tr=http%3a%2f%2ftracker2.dler.org%3a80%2fannounce&tr=http%3a%2f%2ftracker1.bt.moack.co.kr%3a80%2fannounce&tr=http%3a%2f%2ftracker.zerobytes.xyz%3a1337%2fannounce&tr=http%3a%2f%2ftracker.loadbt.com%3a6969%2fannounce&tr=http%3a%2f%2ftracker.lelux.fi%3a80%2fannounce&tr=http%3a%2f%2ftracker.dler.org%3a6969%2fannounce&tr=http%3a%2f%2ftracker.bt4g.com%3a2095%2fannounce&tr=http%3a%2f%2ftr.cili001.com%3a8070%2fannounce&tr=http%3a%2f%2ft.acg.rip%3a6699%2fannounce&tr=http%3a%2f%2frt.optizone.ru%3a80%2fannounce&tr=http%3a%2f%2fretracker.sevstar.net%3a2710%2fannounce&tr=http%3a%2f%2fpow7.com%3a80%2fannounce&tr=http%3a%2f%2fopen.acgnxtracker.com%3a80%2fannounce&tr=http%3a%2f%2ffosstorrents.com%3a6969%2fannounce&tr=http%3a%2f%2f1337.abcvg.info%3a80%2fannounce

Request to make matches case in-sensitive

at the moment, my ini file has *.bob.com but when the malware requested www.BOB.COM, dnschef proxies it

Proxying problem

Hey! I'm making a tool called WiFiSpy and i was thinking of adding a DNSChef options to be able to to DNS Spoofing! :) So i tried it, launched it, and tried to DNS Spoof my Browser, by modifying the HTTP Proxy settings in Firefox, though, i faced one problem! What is the default listening port? I tried doing '--port 8080' but it doesn't work it just says "Proxy is refusing connection"....
Can anyone help me?

INFO:
Command => dnschef --fakeip 192.168.. --fakedomains youtube.com

Proxy Settings:
TYPE: HTTP Proxy (Use this settings for all protocols is checked)
IP: 127.0.0.1
PORT: ???? - Problem

Two or more records per domain

Hello.
How can I specify many records for something domain, like this:
*zone.com=1.2.3.4, 5.6.7.8

Support of SRV records

[!] DNS Record 'SRV' is not supported. Ignoring section contents.

😭

No permission

~/dns> ./dnschef.py
_ _ __ | | version 0.4 | | / |
_| | __ ___ | | | | / ` | ' / |/ | ' \ / _ \ |
| (| | | | _ \ (| | | | __/ | _,|| ||/_|| ||___||
[email protected]

(00:29:03) [] DNSChef started on interface: 127.0.0.1
(00:29:03) [] Using the following nameservers: 8.8.8.8
(00:29:03) [*] No parameters were specified. Running in full proxy mode
(00:29:03) [!] Failed to start the server: [Errno 13] Permission denied

Multiple SRV records with different port and target not allowed

I am receiving a record duplicate error when trying to define a SRV record on different ports or to different targets.

Example 1:

_ldap._tcp.dc._msdcs.test123.local=0 50 389 test123.local
_ldap._tcp.dc._msdcs.test123.local=0 50 53 test123.local

Example 2:

_ldap._tcp.dc._msdcs.test123.local=0 50 389 test123.local
_ldap._tcp.dc._msdcs.test123.local=0 50 389 foo.test123.local

Error message is:

Traceback (most recent call last):
  File "dnschef.py", line 516, in <module>
    config.read(options.file)
  File "c:\pythonPath\lib\configparser.py", line 697, in read
    self._read(fp, filename)
  File "c:\pythonPath\lib\configparser.py", line 1093, in _read
    raise DuplicateOptionError(sectname, optname,
configparser.DuplicateOptionError: While reading from '../dnschef.ini' [line 54]: option '_ldap._tcp.dc._msdcs.test123.local' in section 'SRV' already exists

This setting should be allowed and another example can be seen in https://en.wikipedia.org/wiki/SRV_record

Note: I can use the executable version in windows (0.3) and it does not show me any error.

Ability to turn off answers for ANY

I'd like to be able to turn off the ANY request getting all of the answers.