TEXT   26
hex to scapy dns
Guest on 16th March 2023 01:28:16 PM


  1. firefly:~ user$ cut -c10-  pkt.hex
  2. 4500 0073 8276 0000 3e11 10dd 81aa 1104
  3. 81aa d4ce 0035 fcb1 005f d5bb 6d0f 8180
  4. 0001 0000 0001 0000 0574 6168 6f65 0263
  5. 7309 6461 7274 6d6f 7574 6803 6564 7500
  6. 001c 0001 c012 0006 0001 0000 0b70 0023
  7. c012 0a70 6f73 746d 6173 7465 72c0 1200
  8. 0500 4300 0012 c000 000e 1000 000e 1000
  9. 000e 10
  10.  
  11. firefly:~ user$ cut -c10-  pkt.hex | xxd -rp > pkt.bin
  12.  
  13. // Check that it worked as intended:
  14.  
  15. firefly:~ user$ xxd pkt.bin
  16. 0000000: 4500 0073 8276 0000 3e11 10dd 81aa 1104  E..s.v..>.......
  17. 0000010: 81aa d4ce 0035 fcb1 005f d5bb 6d0f 8180  .....5..._..m...
  18. 0000020: 0001 0000 0001 0000 0574 6168 6f65 0263  .........tahoe.c
  19. 0000030: 7309 6461 7274 6d6f 7574 6803 6564 7500  s.dartmouth.edu.
  20. 0000040: 001c 0001 c012 0006 0001 0000 0b70 0023  .............p.#
  21. 0000050: c012 0a70 6f73 746d 6173 7465 72c0 1200  ...postmaster...
  22. 0000060: 0500 4300 0012 c000 000e 1000 000e 1000  ..C.............
  23. 0000070: 000e 10  
  24.  
  25. // Now to feed it to scapy:
  26.  
  27. firefly:~ user$ scapy
  28. INFO: Can't import PyX. Won't be able to use psdump() or pdfdump().
  29. WARNING: No route found for IPv6 destination :: (no default route?)
  30. Welcome to Scapy (2.3.1)
  31. >>> f = open("pkt.bin", "r")
  32. >>> buff = f.read()
  33. >>> len(buff)
  34. 115
  35. >>> hexdump(buff)
  36. 0000   45 00 00 73 82 76 00 00  3E 11 10 DD 81 AA 11 04   E..s.v..>.......
  37. 0010   81 AA D4 CE 00 35 FC B1  00 5F D5 BB 6D 0F 81 80   .....5..._..m...
  38. 0020   00 01 00 00 00 01 00 00  05 74 61 68 6F 65 02 63   .........tahoe.c
  39. 0030   73 09 64 61 72 74 6D 6F  75 74 68 03 65 64 75 00   s.dartmouth...
  40. 0040   00 1C 00 01 C0 12 00 06  00 01 00 00 0B 70 00 23   .............p.#
  41. 0050   C0 12 0A 70 6F 73 74 6D  61 73 74 65 72 C0 12 00   ...postmaster...
  42. 0060   05 00 43 00 00 12 C0 00  00 0E 10 00 00 0E 10 00   ..C.............
  43. 0070   00 0E 10                                           ...
  44.  
  45. >>> IP(buff).show()
  46. ###[ IP ]###
  47.   version= 4L
  48.   ihl= 5L
  49.   tos= 0x0
  50.   len= 115
  51.   id= 33398
  52.   flags=
  53.   frag= 0L
  54.   ttl= 62
  55.   proto= udp
  56.   chksum= 0x10dd
  57.   src= 129.170.17.4
  58.   dst= 129.170.212.206
  59.   \options\
  60. ###[ UDP ]###
  61.      sport= domain
  62.      dport= 64689
  63.      len= 95
  64.      chksum= 0xd5bb
  65. ###[ DNS ]###
  66.         id= 27919
  67.         qr= 1L
  68.         opcode= QUERY
  69.         aa= 0L
  70.         tc= 0L
  71.         rd= 1L
  72.         ra= 1L
  73.         z= 0L
  74.         ad= 0L
  75.         cd= 0L
  76.         rcode= ok
  77.         qdcount= 1
  78.         ancount= 0
  79.         nscount= 1
  80.         arcount= 0
  81.         \qd\
  82.          |###[ DNS Question Record ]###
  83.          |  qname= '...cs.dartmouth...'
  84.          |  qtype= AAAA
  85.          |  qclass= IN
  86.         an= None
  87.         \ns\
  88.          |###[ DNS Resource Record ]###
  89.          |  rrname= '...dartmouth...'
  90.          |  type= SOA
  91.          |  rclass= IN
  92.          |  ttl= 2928
  93.          |  rdlen= 35
  94.          |  rdata= '\xc0\x12\npostmaster\xc0\x12\x00\x05\x00C\x00\x00\x12\xc0\x00\x00\x0e\x10\x00\x00\x0e\x10\x00\x00\x0e\x10'
  95.         ar= None
  96. >>>
  97. [1]+  Stopped                 scapy
  98.  
  99. // OK, so this is a SOA record, which I got for asking 129.170.17.4 for the
  100. //    AAAA record of
  101. 129.170.17.4 doesn't know, but
  102. //    delegates to
  103.  
  104. // Do I get the same when I ask for that record?
  105.  
  106. firefly:~ user$ dig @129.170.17.4 aaaa ..dartmouth...
  107.  
  108. ; <<>> DiG 9.8.3-P1 <<>> @129.170.17.4 aaaa
  109. ; (1 server found)
  110. ;; global options: +cmd
  111. ;; connection timed out; no servers could be reached
  112.  
  113. // Too bad 129.170.17.4 will not answer to my home network! So I run the same
  114. //   command on tahoe:
  115.  
  116. firefly:~ user$ ssh tahoe dig @129.170.17.4 aaaa
  117.  
  118. ; <<>> DiG 9.10.4-P8-RedHat-9.10.4-5.P8.fc25 <<>> @129.170.17.4 aaaa
  119. ; (1 server found)
  120. ;; global options: +cmd
  121. ;; Got answer:
  122. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51302
  123. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  124.  
  125. ;; OPT PSEUDOSECTION:
  126. ; EDNS: version: 0, flags:; udp: 4096
  127. ;; QUESTION SECTION:
  128. ;
  129. .               IN      AAAA
  130.  
  131. ;; AUTHORITY SECTION:
  132. cs.dartmouth.edu.       3600    IN      SOA ...dartmouth...
  133. postmaster...
  134. 327747 4800 3600 3600 3600
  135.  
  136. ;; Query time: 1 msec
  137. ;; SERVER: 129.170.17.4#53(129.170.17.4)
  138. ;; WHEN: Thu Jun 01 19:30:23 EDT 2017
  139. ;; MSG SIZE  rcvd: 98
Raw Paste

Login or Register to edit or fork this paste. It's free.