Bypassing Firewalls with DNS Tunnelling (Defence Evasion, Exfiltration and Command & Control)

Video Description

In this video we'll be exploring how to attack, detect and defend against DNS Tunnelling, a technique that can bypass certain firewall restrictions and provide an attacker with a command & control and data transfer channel. It can also be used to bypass many of the Captive Portals found on public wifi networks. If you find the video useful please do give it a like, and consider subscribing if you want more of this sort of content. Drop a note in the comments if there’s anything you think I missed, or if you have a good idea of what topic I should cover next. Further reading/watching: Mitre ATT&CK on DNS Tunnelling: https://attack.mitre.org/techniques/T1071/004/ Cynet article on DNS Tunnelling: https://www.cynet.com/attack-techniques-hands-on/how-hackers-use-dns-tunneling-to-own-your-network DNScat2 project page: https://github.com/iagox86/dnscat2 Iodine project page: https://github.com/yarrick/iodine SANS Paper on Detecting DNS Tunnelling: https://www.giac.org/paper/gcia/1116/detecting-dns-tunneling/108367 SecurityOnion: https://securityonionsolutions.com/ Cisco OpenDNS: https://www.opendns.com Audio Credits (licensed under CC0): Intro/Outro Music by Flavio Concini (https://freesound.org/people/Greek555/) Transition audio: "Ethereal Woosh" by Newagesoup (https://freesound.org/people/newagesoup/) Graphics credits: Icons: Sketchy Collection by Ralf Schmitzer, licensed under CCBY (https://thenounproject.com/ralfschmitzer/) Timestamps: 0:00 Intro 2:08 Attack 5:49 Detect 6:53 Defend