DNS Tunneling Overview

Technology Cybersecurity
1

A short presentation of DNS Tunneling.

  • What is DNS Tunnelling? It is a technique used to send non-DNS traffic through standard DNS queries by encapsulating the non-DNS data inside them.
  • Why it Works: Because DNS is a critical component of the internet, enterprises typically leave UDP port 53 open and implement highly permissive policies for DNS traffic. This allows malicious requests to easily hide within the massive volume of benign network noise.
  • Use Cases: While it can be used legitimately for network diagnostics or VPNs, attackers commonly abuse it for data exfiltration, Command-and-Control (C2) communication, and bypassing firewalls or captive portals.

Find PDF here DNS_Tunneling.pdf (1.7 MB)

1 Like