Hands-On Red Team Tactics

Data exfiltration via DNS

Data exfiltration can also be done over DNS to avoid detection. DNSteal is a great tool for this as it creates a fake DNS server, which listens for DNS requests while on the client; we can transfer the file data using simple for loops. This supports single as well as multiple file transfers.

The tool can be downloaded at the following link:

https://github.com/m57/dnsteal

Once downloaded, the tool can be run using the command shown as follows:

python dnsteal.py

This will start the server which will listen on port 53 for incoming connections.

The tool also gives us a command to be run on *nix-based systems. To exfiltrate ...