Bypassing Firewalls with DNS Tunnelling (Defence Evasion, Exfiltration and Command & Control)

Ғылым және технология

In this video we'll be exploring how to attack, detect and defend against DNS Tunnelling, a technique that can bypass certain firewall restrictions and provide an attacker with a command & control and data transfer channel. It can also be used to bypass many of the Captive Portals found on public wifi networks.
If you find the video useful please do give it a like, and consider subscribing if you want more of this sort of content. Drop a note in the comments if there’s anything you think I missed, or if you have a good idea of what topic I should cover next.
Further reading/watching:
Mitre ATT&CK on DNS Tunnelling: attack.mitre.org/techniques/T...
Cynet article on DNS Tunnelling: www.cynet.com/attack-techniqu...
DNScat2 project page: github.com/iagox86/dnscat2
Iodine project page: github.com/yarrick/iodine
SANS Paper on Detecting DNS Tunnelling: www.giac.org/paper/gcia/1116/...
SecurityOnion: securityonionsolutions.com/
Cisco OpenDNS: www.opendns.com
Audio Credits (licensed under CC0):
Intro/Outro Music by Flavio Concini (freesound.org/people/Greek555/)
Transition audio: "Ethereal Woosh" by Newagesoup (freesound.org/people/newagesoup/)
Graphics credits:
Icons: Sketchy Collection by Ralf Schmitzer, licensed under CCBY (thenounproject.com/ralfschmit...)
Timestamps:
0:00 Intro
2:08 Attack
5:49 Detect
6:53 Defend

Пікірлер: 61

  • @skm5779
    @skm5779 Жыл бұрын

    People like you makes KZread a great learning platform. Please continue with this spirit forever. Thank You 🙂

  • @anonymous-ds3mc
    @anonymous-ds3mc3 жыл бұрын

    Straight to the point, short, simple yet informative. Subbed!

  • @bobbyb42
    @bobbyb423 жыл бұрын

    I love the flow of your videos. Feel like I actually retain all the information from the video because of the clear and concise structure. Hope you keep making videos

  • @theburtmacklin9615
    @theburtmacklin96153 жыл бұрын

    Andy, your videos are light years ahead of so many the “cyber / IT security”videos that litter KZread. Content quality and clarity, production value, etc. is all there in spades; I don’t understand how your sub / view counts aren’t much much higher.

  • @rot169

    @rot169

    3 жыл бұрын

    Thank you, that's so very kind of you! I'm clearly not as skilled at building an audience 🤣 Slowly growing though!!

  • @anonymousgirl5150

    @anonymousgirl5150

    3 жыл бұрын

    @@rot169 I'm following a lot of cyber security channels for years , and yours is definitely going places. buckle up, lift of in 10..9..

  • @rot169

    @rot169

    3 жыл бұрын

    Thank you! I really appreciate the kind words! Please do share with any friends/colleagues who you think might be interested :-)

  • @anonymousgirl5150

    @anonymousgirl5150

    3 жыл бұрын

    @@rot169 of course!

  • @Dips_M
    @Dips_M2 жыл бұрын

    Excellent content, one of the most underrated security channels on youtube! Thank you

  • @CharlesHayden
    @CharlesHayden Жыл бұрын

    Awesome presentation describing all the different angles in which to view this from.... 🙏🏾🙌🏾🙏🏾

  • @Heeby-Jeebies
    @Heeby-Jeebies6 ай бұрын

    Your presentation is clear, concise, and very well laid out. Thanks!

  • @aminvogue
    @aminvogue3 жыл бұрын

    A ton of quality info neatly packed in a small video............... Andy's Magic. Thanks

  • @rot169

    @rot169

    3 жыл бұрын

    Thanks, it's great to hear you found it useful :-)

  • @matthewp7586
    @matthewp75863 жыл бұрын

    Brilliant Video. Logical flow, understandable.

  • @septimusseverus252
    @septimusseverus2523 жыл бұрын

    This channel is just simply AMAZING

  • @rot169

    @rot169

    3 жыл бұрын

    Thank you for the kind words!! Please do share any videos with friends/colleagues who you think might also be interested :-)

  • @darshilmehta9905
    @darshilmehta9905 Жыл бұрын

    Underrated channel. Require more videos on Attack as well as Defense Side

  • @jorgebarroso2496
    @jorgebarroso24962 ай бұрын

    Great video! I have just started working around DNS tunneling and your video was very helpful :)

  • @the_hypnotoucan
    @the_hypnotoucan10 ай бұрын

    Great explanation! Thanks for including demos on the Kali Linux side and the client side.

  • @jamel9876
    @jamel98763 жыл бұрын

    Wow. So informative! Keep em coming!

  • @karim3741
    @karim3741 Жыл бұрын

    Flawless Explanation, loved it 👌❤️

  • @faanross
    @faanross Жыл бұрын

    holy crap this is so good, the way you "embedded" the CLIs popping out from the network diagram, bringing wshark into the mix etc - grande pedagogical display, *tips hat*

  • @faanross

    @faanross

    Жыл бұрын

    also speeding up your browsing, respecting the viewers time, A/D/D format etc. glad i discovered you today.

  • @j_r0w
    @j_r0w3 жыл бұрын

    Very informative and quality video, thanks! Subbed :)

  • @ashpakpinjari9214
    @ashpakpinjari92142 жыл бұрын

    You're unstoppable! ‼️

  • @machinelearningdojowithtim2898
    @machinelearningdojowithtim28983 жыл бұрын

    Awesome video Andy!

  • @khanstudy3589
    @khanstudy35892 жыл бұрын

    +10000000 for this video. All cleared

  • @AdityaKumar-ei4ch
    @AdityaKumar-ei4ch3 жыл бұрын

    Very nice video loved it! the animation !

  • @rot169

    @rot169

    3 жыл бұрын

    Thanks! Animation is certainly not my strong point, but making the graphics for these videos has turned me into a PowerPoint master! 😅 I'm trying to avoid having to switch to After Effects for as long as possible!

  • @michaelwaterman3553
    @michaelwaterman35532 жыл бұрын

    This was cool, thanks!

  • @nilbatteysannata1982
    @nilbatteysannata19822 жыл бұрын

    Great content.

  • @sanron4256
    @sanron4256 Жыл бұрын

    Awesome videos.

  • @thewhiterabbit661
    @thewhiterabbit6613 жыл бұрын

    Very good channel thank you

  • @bellamymusicofficial7915
    @bellamymusicofficial79152 жыл бұрын

    Please keep it up sir 🍻

  • @manqingzhou2925
    @manqingzhou2925 Жыл бұрын

    great content

  • @darkanyons
    @darkanyons2 жыл бұрын

    Wow! thanks!

  • @josephlustigiermbong5121
    @josephlustigiermbong51213 жыл бұрын

    Très bonne vidéo merci beaucoup +1 abonné

  • @rot169

    @rot169

    3 жыл бұрын

    Merci Joseph! :)

  • @sul3y
    @sul3y3 жыл бұрын

    Man youre amazing

  • @Kink-Panther
    @Kink-Panther Жыл бұрын

    Can this effect cellphones like andoird. Cause I went on a website and accepted the link but soon after my phone ask for private access and should only be accepted by my service provider but I've declined So would my phone be infected

  • @mylife3003
    @mylife30032 ай бұрын

    Good

  • @HughJass-jv2lt
    @HughJass-jv2lt2 жыл бұрын

    ❤❤

  • @PubRunner
    @PubRunner6 ай бұрын

    I have a web server running that has a gps server that has a self signed certificate and I use TailScale to bypass where I works firewall that disallowed connections to sites with self signed or invalid certificates. While what I am running is benign, I could in theory and anything running. I also use TailScale to access Files I need from time to time that I don’t want to keep a copy on the laptop (which I own) that I use for work. I cannot connect to my GPS server at all if I use its full URL but can if I use its local host name of their network. I use my GPS server to calculate mileage on my personal vehicles which I get compensated for use during work hours and I can prove my location and route between sites if that is ever questioned. I should also add that the portion of the network I have access to at where I work isn’t the main secure backbone only authorised company owned PCs have access that.

  • @RakibHasan-hs1me
    @RakibHasan-hs1me2 жыл бұрын

    I will stick around till the attacking path

  • @vibrato17
    @vibrato172 жыл бұрын

    I'm confused, at 2:40, the attacker seems to already have access to the victim machine in order to run dnscat, so why is DNS tunneling even needed?

  • @a28bre55

    @a28bre55

    Жыл бұрын

    Good question. Hope he answers it.

  • @pradeepkumarpalanisamy2425

    @pradeepkumarpalanisamy2425

    6 ай бұрын

    This is sort of post exploitation attack to deploy command and control mechanism and can greatly help hacker in exfiltrating the data.

  • @trebbomb25
    @trebbomb252 жыл бұрын

    Why would the client go to the hacker's domain in the first place? Before this attack can happen i would imagine some type of web spoofing would need to happen correct? As the hacker's DNS server only accepts queries for that one specific domain?

  • @rot169

    @rot169

    2 жыл бұрын

    This technique is specifically around achieving an exfil/C2 channel; a real-world attack would depend on some other technique being used (maybe just a simple phish?) to get the attacker's code running on their victim's machine. I hope this helps! :-)

  • @trebbomb25

    @trebbomb25

    2 жыл бұрын

    @@rot169 definitely, thanks!

  • @harshamannewton
    @harshamannewton2 жыл бұрын

    the speed sucks tho....any idea to increase speed?

  • @rot169

    @rot169

    2 жыл бұрын

    DNS Tunnelling is an inefficient means of transferring data, so there's not much you can really do to improve the speed of it. Which is good from a defender's point of view as it means there's more time to detect and respond to large data transfers.

  • @nxhad
    @nxhad Жыл бұрын

    how do i setup dnscat2 on windows?

  • @user-cf5su4te9s
    @user-cf5su4te9s3 жыл бұрын

    skills only for windows ? attack| defect| defent ... no web attacks ? no linux attacks skills ...

  • @rot169

    @rot169

    3 жыл бұрын

    Haha, yeah just Windows for now... although I have other non-windows topics in the pipeline, so stay tuned... :-)

  • @Mohitkumar-ug8jq
    @Mohitkumar-ug8jq Жыл бұрын

    u r too fast

Келесі