3 ms·
they're dropping everything but DNS and HTTP from a proxy That won't help them either anymore: Weaponizing dnscat with shellcode and Metasploit http://news.yc
by miles 17y ago
they're dropping everything but DNS and HTTP from a proxy
That won't help them either anymore:
Weaponizing dnscat with shellcode and Metasploit
http://news.ycombinator.com/item?id=1204931 http://news.ycombinator.com/item?id=1204931
- tptacek 17y ago(a) My point isn't that enterprises can solve the (fundamentally intractable) covert channel problem. It's that this NAT tunnelling code won't work on corporate networks. (b) DNS tunneling is also clever, but it's loud, easily detected, easily defeated, and extremely likely to get you fired.
- miles 17y agoThank you for the followup! A quick question: after reading over "Detecting and preventing the use of DNScat" on this page: http://tadek.pietraszek.org/projects/DNScat/ http://tadek.pietraszek.org/projects/DNScat/ , it seems as if uncovering small amounts of data sent this way might be difficult. Here are the detection techniques mentioned: detecting unusual and malformed DNS packets (DNScat will evade this) detecting high number of unusual types of DNS queries (e.g. TXT) (DNScat will also evade this) Anomaly detection: DNS query and response length Anomaly detection: profiling the amount of traffic per client source IP address Are there any other detection methods?