deserter

A targeted DNS cache poisoner.

Report Bug · Request Feature

Table of Contents

1. About The Project
   • Highlights
2. Getting Started
   • Prerequisites
   • Installation
   • Installation with support for multiple queries in a single request
3. Usage
4. Roadmap
5. Contributing
6. License
7. Contact

About The Project

deserter is a targeted DNS cache poisoner. It is capable of DNS cache poisoning without bruteforcing the target ID and source port - instead, it sniffs out DNS probes and uses the information inside to craft poisoned responses and send them back to the target.

Highlights

• Silence - deserter doesn't flood the network with any type of packet - it only ever sends a single response per query received
• Speed - written in C++, the tool is fast which is required when racing against packets coming from the legitimate name server
• Robustness - deserter supports both A and AAAA record types. Support for authority poisoning and DNS over IPv6 is also coming!

Getting Started

To get a local copy up and running follow these simple steps.

Prerequisites

In order for the tool to work, the attacker needs to be on the same network as the victim. Sometimes, arp spoofing may also be required - usually on physical connections through Ethernet.

Installation

1. Clone the repo with its submodule

git clone --recurse-submodules https://github.com/cr0mll/deserter

2. Install libpcap

sudo apt-get install libpcap-dev

3. Change into deserter/scripts

cd deserter/scripts

4. Change the permissions for the installation script and run it

chmod +x install.sh

./install.sh

Installation with support for multiple queries in a single request

1. Clone the repo with its submodule

git clone --recurse-submodules https://github.com/cr0mll/deserter

2. Change into deserter/scripts

cd deserter/scripts

3. Change the permissions for the installation script and run it with the SUPPORT_MULTIPLE_QUERIES_IN_A_SINGLE_REQUEST option

chmod +x install.sh

./install.sh SUPPORT_MULTIPLE_QUERIES_IN_A_SINGLE_REQUEST

Usage

The tool requires sudo permissions to be run. You can run deserter with --help to get information about all of the available options. Three of them are required:

• -t - the IPv4 address of the victim
• -b - the IPv4 address to poison resource records with
• -i - the interface to use (IP address or a name)

Performing a DNS cache poisoning

The following syntax can be used for a simple DNS cache poisoning attack:

./deserter -t <victim IP> -b <bad IP> -i <interface>

or

./deserter --target <victim IP> --bad_ip <bad IP> --interface <interface>

We are successful:

Specifying domains to poison

It is also possible to specify which domains you want deserter to poison by using the --domains or -d options and then specifying a list of domains separated by commas without spaces:

./deserter -t <victim IP> -b <bad IP> -i <interface> -d domain1,domain2,domain3,...

Poisoning AAAA records

deserter is capable of poisoning AAAA records, as well. You will need to specify the --bad-ipv6 option followed by the IPv6 address you want to poison the cache with:

Continuous packet capture

By default, deserter ends its execution after poisoning a single probe. You can tell it to continue waiting for packets and poisoning them by specifying the --keep-alive command-line argument:

Roadmap

• Support for DNS over IPv6
• See the open issues for a list of proposed features (and known issues).

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

License

Distributed under the MIT License. See LICENSE for more information.

Contact

Project Link: https://github.com/cr0mll/deserter