DNS Spoofing with PowerDNS

782 views Asked by At

I want to modify the DNS query answer that PowerDNS returns by replacing the IP of the domain with the IP of a static page. I know the place to do this modification is in the startDoResolve function in pdns_recursor.cc. However I am having trouble figuring out where exactly the IP gets inserted into the response packet. Anyone having experience working with PowerDNS who can help me out with this?

1

There are 1 answers

0
stena On

It seems, you are using PowerDNS Recursor. The standard way of doing this is via the lua extensions. Depending on the criteria, when you want to spoof, you probably want to use one of the query interceptor function specified in the lua scripting documentation

You may also be interested in the spoofing capabilities mentioned in the dnsdist Packet Policies documentation. For example: addAction(domain, SpoofAction({IP[,…]}))