How does DNS Tunneling exfiltrate data?

Question

Eduardo Rives · Accepted Answer

An attacker registers a domain that a client connects to based on DNS records and sends malware through that connection.

Eduardo Rives · Answer

An attacker opens a reverse DNS shell to get into the client's system and install malware on it.

Eduardo Rives · Answer

An attacker uses a non-standard DNS port to gain access to the organization's DNS servers in order to poison the resolutions.

Eduardo Rives · Answer

An attacker sends an email to the target with hidden DNS resolvers in it to redirect them to a malicious domain.

List of questions