Data exfiltration can also be done over DNS to avoid detection. DNSteal is a great tool for this as it creates a fake DNS server, which listens for DNS requests while on the client; we can transfer the file data using simple for loops. This supports single as well as multiple file transfers.
The tool can be downloaded at the following link:
https://github.com/m57/dnsteal
Once downloaded, the tool can be run using the command shown as follows:
python dnsteal.py
This will start the server which will listen on port 53 for incoming connections.
The tool also gives us a command to be run on *nix-based systems. To exfiltrate data, we use that command and paste it in the client's shell as shown as follows:
This will send password.txt to our server and we will receive the file on our server as shown as follows.
Once the file transfer has completed, we...
