Spix0r Spix0r

Data Exfiltration Using DNS (Out-Of-Band)

Description

In an Out-Of-Band (OOB) situation where direct responses to requests are unavailable, we can leverage DNS (specifically UDP) to exfiltrate data. In this example, we'll demonstrate how to use dig to query DNS and exfiltrate information such as the username (whoami), and how to handle more complex data like the output of uname -a by encoding it before exfiltration.

Prerequisites

If you haven't configured your OOB server yet, you can follow this guide:
https://gist.github.com/Spix0r/9661d448a08bf0703b005c3c64aef560

Out-of-Band DNS Bind Server Setup (Manual Guide)

Note: Be sure to replace all instances of example.com with your actual domain and <Your Server IP> with your server IP address during configuration.

Overview

Out-Of-Band (OOB) techniques offer attackers a strategic approach to confirm and exploit vulnerabilities that might be otherwise classified as "blind." In scenarios where direct responses to requests are not available, OOB methods leverage the capability of vulnerable systems to generate outbound traffic, such as TCP, UDP, or ICMP requests. This allows an attacker to exfiltrate data discreetly, utilizing the inherent behavior of the target to bypass conventional security measures.

In the context of DNS, setting up an OOB server can facilitate data exfiltration by encoding sensitive information within DNS queries. Since DNS traffic often escapes scrutiny from firewalls and intrusion detection systems, this approach presents a unique opportunity for attackers. The effectivene

	import requests
	import re
	import base64
	import json

	# Step 1: Fetch main page HTML from a user-provided link.
	page_content = requests.get(input("Enter URL: ")).text

	# Step 2: Extract the 'embed_code' from the page.
	embed_code = re.search(r'<script src="https://example.com/(.*)/embed', page_content).group(1)

	Allow: CONNECT
	Allow: GET
	Allow: HEAD
	Allow: POST
	Allow: TRACE
	Client-IP: 0
	Client-IP: 0177.0000.0000.0001
	Client-IP: 0x7F000001
	Client-IP: 10.0.0.0
	Client-IP: 10.0.0.1