DNS Tunneling
MITRE ATT&CK™ Protocol Tunneling - Technique T1572
Last updated
MITRE ATT&CK™ Protocol Tunneling - Technique T1572
Last updated
DNS Tunneling also known as TCP over DNS, is another method used for covert communication and circumventing network security measures. In DNS tunneling, data is encoded in DNS queries and responses to create a communication channel between two endpoints. DNS, which is primarily designed for translating domain names to IP addresses, becomes a carrier for data that may not be related to traditional domain resolution.
DNS tunneling may also be used as an exfiltration channel.
iodine is a C software that lets you tunnel IPv4 data through a DNS server. On the attacking machine we can run the server:
On the compromised host, the jumpbox, we will setup the iodine client:
Now the attacking machine and the compromised host are sending traffics throught the dns0 interface. All communication over this interface on the network 10.1.1.1/24 will be over the DNS. We can then setup a socks5 proxy using the -D argument of ssh client.
