For the bad apple one; I tried something like that, it works if you're directly querying the authoritative DNS server, but if a cache is involved the records will be re-ordered by randomisation (even in some cases with TTL=0). That's why I ended up doing this as a single very long record, because then it can be cached without worrying about reordering.
But ideally it'd be blocked and all traffic would go through an internal caching resolver, right? To reduce internal latency and load on outside servers, but also to have records if needed and to block whack requests or responses if needed.
And that also leaves out the common things like MX records.
If you run "strings" you should see "av01Image" pretty early on in the HEIF header, which is what signals it's really an AVIF file. Tools like "file" may possibly not be updated to look for that yet, so could just report the container alone.
else if (c.slice(4, 4+4) == "ftyp") f="avif";
I used to do a lot of consulting work at locations with extremely locked down networks. I could use iodine + wireguard to punch through most firewalls, slow, but effective.
Just using DNS for data exfiltration, in general, is usually pretty fruitful. I wrote a "live off the land" data exfil script for Windows once, using the certutil and nslookup commands to base64 encode data and ship it out to my off-site DNS server.
I'll have to try it against a Palo Alto NGFW sometime and see what alarms I trip. I honestly never thought to try.
Throttling and tiering can definitely affect more people than you might suspect (like spiky services) and considering data and use are important.
cyanmagenta•4mo ago
dgl•4mo ago
KPGv2•4mo ago
It's pretty cool how this tech has evolved. UDP has become so much more reliable that you can even do SSL over UDP, with a complex mechanism meant to account for dropped packets during the handshake process.
m3047•4mo ago
cyanmagenta•4mo ago
You could even do this over UDP if you really wanted, just merging a bunch of 1200-byte records together
m3047•4mo ago
https://github.com/m3047/rear_view_rpz/blob/b17cf943ccd7498d...