# How to use fake DNS server in HTTPS MITM?

**URL:** <https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725>\
**Category:** help\
**Created:** [November 24, 2017, 1:55pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725 "2017-11-24T13:55:16Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [November 24, 2017, 1:55pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/1 "2017-11-24T13:55:16Z")

</div>

Instead of using the standard gateway to redirect connections, one could also think of using a fake DNS server to do HTTPS MITM. Or We can modify the /etc/hosts. In this case ,the destination address of HTTPS was modified to the Proxy Address. How does mitmproxy get the correct server name? Maybe the proxy can use SNI as the server name, but i don’t know how to do.

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [November 25, 2017, 10:51am UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/2 "2017-11-25T10:51:16Z")

</div>

You may want to look at [https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/dns\_spoofing.py](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/dns_spoofing.py). It’s a fairly brittle setup in my opinion, so I would always recommend setting up a regular proxy or a transparent one if necessary. For example, any hardcoded IPs would bypass IP spoofing. 🙂

---

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [November 25, 2017, 1:33pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/3 "2017-11-25T13:33:14Z")

</div>

Thanks very much. This is what i need.

---

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [December 7, 2017, 1:50am UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/4 "2017-12-07T01:50:17Z")

</div>

It seems that SNI or HTTP Host header dosen’t work for dns\_spoofing.py。  
But I’m sure SNI and HTTP Host header exists.

When i use this command:  
sudo mitmproxy -p 443 -s dns\_spoofing.py -R [http://www.example.com/](http://www.example.com/)  
It always display [http://www.example.com](http://www.example.com)

When i use this command:  
sudo mitmproxy -p 443 -s dns\_spoofing.py  
The browser always display error messages：  
502 Bad Gateway

ProtocolException(‘Cannot connect to server, no server address given.’,)

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [December 9, 2017, 8:38pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/5 "2017-12-09T20:38:31Z")

</div>

@MillionSky, do you have a reproducible example (e.g. using curl) for this?

---

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [December 21, 2017, 3:12am UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/6 "2017-12-21T03:12:09Z")

</div>

This is my whole step:

1. import mitmproxy-ca-cert.pem
2. use bind or /etc/hosts to redirect [www.baidu.com](http://www.baidu.com) to the server running mimproxy.  
The website is for test.
3. sudo sysctl -w net.ipv4.ip\_forward=1
4. run mitmproxy  
sudo mitmproxy -p 443 -s dns\_spoofing.py -R [https://www.baidu.com](https://www.baidu.com)  
It works fine.  
But if -R not specified, the browser always display error messages：  
502 Bad Gateway

ProtocolException(‘Cannot connect to server, no server address given.’,)

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [December 26, 2017, 4:52pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/7 "2017-12-26T16:52:32Z")

</div>

Looking at [https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/dns\_spoofing.py](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/dns_spoofing.py), it seems to me that you are missing `--keep-host-header`. Without that, mitmproxy will rewrite the host header before redirection takes place, which likely is your issue.

---

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [December 27, 2017, 12:21am UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/8 "2017-12-27T00:21:19Z")

</div>

But there is no this option：  
millionsky@ubuntu-16:~$ sudo mitmproxy -p 443 -s dns\_spoofing.py -R [https://www.baidu.com](https://www.baidu.com) --keep-host-header  
usage: mitmproxy [options]  
mitmproxy: error: unrecognized arguments: --keep-host-header

I tried Self-contained Pre-built Binary Packages and source install, neither has this option.  
This is Self-contained Pre-build Binary Packages install:  
wget [https://github.com/mitmproxy/mitmproxy/releases/download/v2.0.2/mitmproxy-2.0.2-linux.tar.gz](https://github.com/mitmproxy/mitmproxy/releases/download/v2.0.2/mitmproxy-2.0.2-linux.tar.gz)  
tar zxvf mitmproxy-2.0.2-linux.tar.gz  
sudo mv mitmproxy mitmdump mitmweb /usr/local/bin/

This is source install:  
sudo apt-get install python3-dev python3-pip libffi-dev libssl-dev  
pip3 install -U pip  
sudo pip3 install mitmproxy

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [December 27, 2017, 9:03pm UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/9 "2017-12-27T21:03:19Z")

</div>

Sorry, this might only be available on master/soon-to-be 3.0, where it’s `--set keep_host_header`. We should have a release candidate soon-ish, feel free to use the dev builds at [snapshots.mitmproxy.org](http://snapshots.mitmproxy.org) until then.

---

<div class="post-metadata">

**Author:** ![MillionSky](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@MillionSky](https://discourse.mitmproxy.org/u/MillionSky)\
**Post date:** [December 28, 2017, 12:19am UTC](https://discourse.mitmproxy.org/t/how-to-use-fake-dns-server-in-https-mitm/725/10 "2017-12-28T00:19:06Z")

</div>

OK，Thanks very much! I will try it.