Skip to content

Instantly share code, notes, and snippets.

@manuel-delverme
Created August 12, 2021 18:49
Show Gist options
  • Save manuel-delverme/73216938db95b261e5585408e1552f9f to your computer and use it in GitHub Desktop.
Save manuel-delverme/73216938db95b261e5585408e1552f9f to your computer and use it in GitHub Desktop.
from scapy.all import rdpcap, DNSQR, DNSRR
f = ""
last = ""
for p in rdpcap('doNotSnoop.pcapng'):
if p.haslayer(DNSQR) and not p.haslayer(DNSRR):
qry = p[DNSQR].qname.replace(".jz-n-bs.local.", "").strip().split(".")
qry2 = []
for q in qry:
try:
q = q.decode('hex')
except TypeError as e:
print(e, q)
qry2.append(q)
qry = ''.join(qry2)[9:]
if last != qry:
print(qry)
f += qry
last = qry
with open("cake", "wb") as fout:
fout.write(f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment