TheDNSMuseum
← Back to collection

Tunnelling

dnscat2

A DNS tunnelling tool that makes traffic resemble ordinary DNS requests.

tunneldual usedetection

Screenshot used in the talk for dnscat2
Screenshot used in the original talk.

dnscat2 is a well-known example of an interactive channel transported through DNS. Its traffic can look superficially normal, which makes it relevant to both protocol history and security monitoring.

This museum entry keeps the focus on classification and context. Detailed defensive material belongs in the planned DNS abuse section.

Primary source: https://github.com/iagox86/dnscat2