TheDNSMuseum
← Back to collection

Tunnelling

dnscat2

dnscat2 carries a full TCP/IP session through DNS and supports interactive traffic such as files and messages; its DNS-like appearance makes monitoring important.

tunneldual usedetection

Date updated:

Screenshot used in the talk for dnscat2
Screenshot used in the original talk.

dnscat2 carries an interactive TCP/IP session through DNS and supports tasks such as file transfer and messaging. The talk notes that the traffic can resemble ordinary DNS, which makes it relevant to security monitoring and incident response.

This exhibit describes the technique and its defensive context without operational setup instructions.

Primary source: https://github.com/iagox86/dnscat2