3 ms·
Any modern enterprise firewall has app identification built in and will quickly identify you trying to send non dns traffic. And after the solarwinds debacle
by tw04 3y ago
Any modern enterprise firewall has app identification built in and will quickly identify you trying to send non dns traffic. And after the solarwinds debacle, everyone with a security team is looking for it.
- commandlinefan 3y agoWell, there'd be no way for a firewall to block a request like: dig -b peername data.data.data.data And let the "name server" on the other end listening on port 53 parse the data. You _would_ have to be able to listen on port 53 and of course it would be slow as hell, but it's unblockable.
- JackGreyhat 3y agoCheck this: https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunn... See the "Preventing DNS Tunneling" chapter.
- commandlinefan 3y agoInteresting, thanks. Seems like the firewall would have to be specifically configured to block, say "WebRTC through DNS tunneling" in this case, though.