TechKnowSurge
TechKnowSurge Catalog Videos Stealth Technique: DNS Tunneling
VideoSecurityFree

Stealth Technique: DNS Tunneling

DNS tunneling is a technique that exploits DNS traffic to covertly exfiltrate data from a network by embedding information within DNS queries and responses. Because DNS is essential infrastructure that cannot simply be blocked, it presents an attractive and often overlooked channel for adversaries.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DNS tunneling is an attack technique that abuses the DNS protocol to covertly move data in and out of a network. DNS is foundational to modern network communication, translating human-readable domain names into IP addresses, and because it cannot be blocked without breaking critical functionality, it becomes an attractive channel for adversaries looking to bypass security controls. By embedding encoded data into the subdomain or host field of a DNS query, an attacker can route information to a DNS server under their control without triggering the same scrutiny applied to conventional network traffic. The server receives the manipulated query, decodes the payload, and can respond with additional data encoded in the reply, enabling full bidirectional communication over what appears to be normal DNS activity. The technique takes advantage of the variety of available DNS record types, including A, TXT, MX, CNAME, and NULL records, any of which can serve as a carrier depending on the attacker's objective. Data is not transmitted all at once but is fragmented across multiple queries, which adds a layer of obfuscation and makes detection more difficult. DNS tunneling therefore functions simultaneously as a tunneling method, an obfuscation technique, and a fragmentation strategy, making it a particularly versatile tool for data exfiltration and covert command-and-control communication.

What you'll learn

What's covered

DNS Tunneling

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Data Exfiltration
The unauthorized transfer of data from a system to an external destination.
DNS Tunneling
A technique that encodes and smuggles data within DNS query and response messages to exfiltrate information from a network.
Obfuscation
The deliberate manipulation of data, code, or a URL to disguise its true purpose and evade detection by security tools or users. Malware authors use obfuscation to hide malicious behavior; attackers use it in phishing URLs to disguise destinations.
Data Fragmentation
The process of breaking data into smaller pieces for transmission, used in DNS tunneling to avoid detection by sending exfiltrated data incrementally.

Topics

Dns Tunneling Data Exfiltration Network Security Stealth Techniques Threat Detection Dns

Transcript

DNS Tunneling

Another type of tunneling is DNS tunneling: tunneling through some sort of DNS messages.

One thing that's pretty critical for most of our machines and for the networks that we manage is DNS. DNS is a huge part of what really drives us to be able to communicate across the network, as we're typically not doing it by IP address; we're typically doing it by domains. So we need the DNS system in order to resolve things. It's not something we can just stop — we can't just stop DNS traffic. But as an adversary, we can utilize DNS traffic to smuggle information out of a network, and so we call this DNS tunneling.

How It Works

When we use DNS traffic to smuggle information out: if I'm headed to www.technodj.com, then I am going to the host www with the domain technodj.com. So what I need to do is resolve this to an IP address. What my machine does is it sends out a DNS query and says, hey, who belongs to www.technodj.com?

It's just as easy to send some sort of DNS request that has something strange in the host side of this right here. It's still going to make it to the DNS server as it sends it to the DNS server, but it's trying to resolve something like this random what looks like random letters and numbers here. Well, what this could be is some sort of data exfiltration, where data is being inserted into here and then being sent to the DNS server.

DNS Record Types and Two-Way Communication

There's actually a lot of different DNS record types. There's text records, there's MX records, there's server records, null, there's A, and there's CNAME. So depending on what we're trying to achieve, we can use any one of these types of DNS records, and the reply too, as the reply gets sent back. So part of this is that it can have a two-way communication back and forth, because that's the way DNS works: it sends out a request and then the reply comes back.

So here's the attack card on DNS tunneling. That's where we're sending this information through to some sort of DNS server, so that way we're exfiltrating this data, or we're getting this data out. So really, it's a form of tunneling, it's a form of obfuscation, and it's a form of fragmentation, because we don't send all of the data at once — we're fragmenting it.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →