ProxymanApp / ProxymanApp/Proxyman

Support multicast DNS in DNS spoofing

Open
#2,300 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
No language data
Stars
7k
Forks
237
PR merge metrics
No merged PRs in 30d

Description

Description

I could have sworn this worked or at least partly worked at one time but it doesn't seem to now. I use proxyman often for docker containers. The containers themselves have internal names, like backend. I use orbstack which also puts a multicast dns entry for that container at backend.orb.local.

I would like to then, dns spoof backend -> backend.orb.local.

This allows me to proxy even containers talking to themselves. conainter_a makes a request to container b in the internal docker network. But I have proxied it. So container_a goes to proxyman looking for container_b. Proxyman spoofs to container_b.orb.local. I see ANY and ALL traffic internal or not.

But as far as I can tell, to get the IP of backend.orb.local proxyman consults standard dns. (nslookup does not find *.local for instance). I can emulate getting a .local or public DNS result with python.

>>> import socket
>>> print(socket.gethostbyname('www.google.com'))
142.250.72.4
>>> print(socket.gethostbyname('backend.orb.local'))
198.19.248.13

It would be great if proxyman could use that equivalent lookup on mac when dns spoofing a .local domain.

ADDITIONALLY it would be really nice to have a column in the captured requests that showed if a DNS spoof or map remote occurred for any request, and some details.

Why this feature/change is important?

It's much nicer to maintain a set of DNS spoofs and make that a central setting rather than having to write a map remote for every container I have.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported backend.orb.local case on macOS, comparing standard DNS lookup with Python's socket.gethostbyname result. Then trace the DNS spoofing workflow and captured-request presentation; done means .local spoofing resolves and the capture view identifies DNS spoof or map-remote effects with details.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, macos
Domain
devtools, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.