域名劫持抓包

import dns.resolver
import socket
import struct

def dns_query(domain):
    try:
        answers = dns.resolver.resolve(domain, 'A')
        for rdata in answers:
            print(f'{domain} resolved to {rdata}')
    except dns.resolver.NXDOMAIN:
        print(f'{domain} does not exist.')
    except dns.resolver.NoAnswer:
        print(f'{domain} has no A records.')
    except dns.resolver.Timeout:
        print(f'{domain} query timed out.')

def capture_packets():
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
        s.bind(('eth0', 0))
        s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
        s.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

        while True:
            packet, addr = s.recvfrom(65535)
            ip_header = packet[0:20]
            iph = struct.unpack('!BBHHHBBH4s4s', ip_header)
            s_addr = socket.inet_ntoa(iph[8])
            d_addr = socket.inet_ntoa(iph[9])
            print(f'Received packet from {s_addr} to {d_addr}')

            tcp_header = packet[20:40]
            tcph = struct.unpack('!HHLLBBHHH', tcp_header)
            if tcph[5] == 53:  # DNS query
                print('DNS query detected')
                dns_payload = packet[40:]
                dns_header = dns_payload[:12]
                dns_id, dns_flags, dns_qdcount, dns_ancount, dns_nscount, dns_arcount = struct.unpack('!HHHHHH', dns_header)
                print(f'DNS ID: {dns_id}')
                print(f'DNS Flags: {dns_flags}')
                dns_questions = dns_payload[12:12 + dns_qdcount * 12]
                for i in range(dns_qdcount):
                    qname, qtype, qclass = struct.unpack_from('!BHB', dns_questions, i * 12)
                    qname = qname & 0xC0 | ((qname >> 8) & 0x3F)
                    print(f'Question: {qname}, Type: {qtype}, Class: {qclass}')
    except KeyboardInterrupt:
        s.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)
        s.close()

if __name__ == '__main__':
    domain = 'example.com'
    dns_query(domain)
    capture_packets()