(self, *args, **kwargs)
| 23 | class DshellPlugin(dnsplugin.DNSPlugin): |
| 24 | |
| 25 | def __init__(self, *args, **kwargs): |
| 26 | super().__init__( |
| 27 | name="special-ips", |
| 28 | description="identify DNS resolutions that fall into special IP (IPv4 and IPv6) spaces (i.e. private, reserved, loopback, multicast, link-local, or unspecified)", |
| 29 | bpf="port 53", |
| 30 | author="dev195", |
| 31 | output=AlertOutput(label=__name__), |
| 32 | longdescription=""" |
| 33 | Identifies DNS resolutions that fall into special IP spaces (i.e. private, |
| 34 | reserved, loopback, multicast, link-local, or unspecified). |
| 35 | |
| 36 | When found, it will print an alert for the request/response pair. The alert |
| 37 | will include the type of special IP in parentheses: |
| 38 | (loopback) |
| 39 | (private) |
| 40 | (reserved) |
| 41 | (multicast) |
| 42 | (link-local) |
| 43 | (unspecified) |
| 44 | |
| 45 | For example, to look for responses with private IPs: |
| 46 | Dshell> decode -d specialips ~/pcap/SkypeIRC.cap |grep "(private)" |
| 47 | [special-ips] 2006-08-25 15:31:06 192.168.1.2:2128 -- 192.168.1.1:53 ** ID: 12579, A? voyager.home., A: 192.168.1.1 (private) (ttl 10000s) ** |
| 48 | |
| 49 | Finding can also be written to a separate pcap file by chaining: |
| 50 | Dshell> decode -d specialips+pcapwriter --pcapwriter_outfile="special-dns.pcap" ~/pcap/example.pcap |
| 51 | """, |
| 52 | ) |
| 53 | |
| 54 | |
| 55 | def dns_handler(self, conn, requests, responses): |
nothing calls this directly
no test coverage detected