TechKnowSurge
TechKnowSurge Catalog Videos Stealth Technique: Tunneling
VideoSecurityFree

Stealth Technique: Tunneling

Tunneling is a network stealth technique that encapsulates Layer 3 packets under a new header to reroute traffic covertly, often combined with encryption to form a VPN connection between an attacker and a compromised machine.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Tunneling is a stealth technique used to move data across a network covertly by encapsulating an original Layer 3 packet within a new Layer 3 header. Under normal routing, a packet travels from router to router based on its source and destination IP addresses until it reaches its intended endpoint. Tunneling overrides this by placing a different Layer 3 header on the outside of the original packet, so the network routes traffic according to the outer header instead. This gives an attacker fine-grained control over where packets are sent, including back to a machine under their control, without revealing the true nature of the underlying traffic. A practical application of this technique involves capturing packets on a compromised host and using a tunneled connection to forward that captured data to an attacker-controlled machine. The original packet remains intact inside the encapsulation, and the outer header dictates delivery. When encryption is added to the encapsulated payload before the new header is applied, the result is a Virtual Private Network — a VPN. In an offensive context, a VPN established between a compromised machine and an attacker's system creates an encrypted, hidden channel that makes the intercepted traffic unreadable to anyone monitoring the network. Tunneling is a flexible technique because it can span multiple protocols and serve purposes ranging from network extension to full covert command-and-control communication. The combination of encapsulation and encryption makes it particularly difficult to detect, since the traffic appears structurally legitimate and its contents are opaque. Understanding how tunneling works at the packet level is essential for both identifying it during threat analysis and implementing defenses that can recognize abnormal encapsulation patterns in network traffic.

What you'll learn

What's covered

Tunneling as Stealth Technique

Key terms

Tunneling
A transition mechanism that encapsulates IPv6 packets within IPv4 headers (or vice versa) to carry traffic across a network that uses a different IP version.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Layer 3
The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.
Data Exfiltration
The unauthorized transfer of data from a system to an external destination.
Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.

Topics

Network Tunneling Data Exfiltration Stealth Techniques Vpn Packet Encapsulation Networking Adversarial Tactics

Transcript

Another stealth technique that we can use to get information in and out of the network without being discovered is tunneling.

What Tunneling Does

Tunneling is the idea that we get a new header for this layer 3 packet. So here we have just a regular layer 3 packet, and in this we have a layer 3 header. The layer 3 header has a source and destination IP address, and what happens is that this gets routed from router to router until it gets to its destination. That's regular routing for a regular packet.

But tunneling is the idea that we're going to actually put a different layer 3 header on this, and now it's going to get routed according to this different layer 3 header. So it could be routed a little differently to get to its final destination based off of this different source and destination IP address.

So for instance, if we wanted something to be tunneled to us, we could possibly disguise it by putting a different header on the front of it and then send it directly to us. One example might be if we were doing sniffing on this network and packets were making it to our compromised machine here. One way to get it back to us would be to put a different layer 3 header on there and then have it come back to us, and now the original packet is still intact.

Tunneling with Encryption

Probably a little more common though is we do some sort of encryption. So what we would do is we would encrypt this layer 3 packet right here, and then we put a new layer 3 header on this, and then send it our way. This actually creates what's called a virtual private network, or VPN. A VPN is an encrypted tunnel. So then we would get traffic from the compromised machine right here to our machine via encrypted tunnel. That's one way: establish a VPN between the adversary and the compromised machine.

The Attack Card

Here's the attack card on the stealth technique of tunneling. Tunneling is a way that we can use some sort of encapsulation and encapsulate the original layer 3 packet, and then it could be used for like extending a network, or sending it our way, or going across other protocols. So it's a way to get traffic to us, but we can also encrypt it. So it's commonly used with encryption to get packets to our machine from some other machine. If that information were encrypted we'd call that a virtual private network, or VPN. So we could establish this VPN connection so no one else could see what this traffic looked like, because it was encrypted.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →