← Back to Labs

DNS Tunneling & Data Exfiltration

Step through DNS recursive lookup delegation, Base32 subdomain payload encoding, TXT record tunnels, and Shannon entropy detection

RECURSIVE DNS NETWORK FLOWClient Host10.0.4.15FirewallHTTP BlockDNS Resolver10.0.0.2Attacker NSc2.attacker.comSTATUS & QUERY DATAN/A (Direct HTTP Egress Blocked)ENTROPY ANALYTICS ($H$)H(X) = - Σ p(x) log₂ p(x)Normal FQDN (mail.google.com)H = 2.40Tunnel FQDN (Base32 Label)H = 4.25Threshold 3.8Monitoring PipelineAnalyzing FQDN character frequenciesTCP/80,443 Blocked | UDP/53 AllowedPHASE: Firewall Egress InspectionACTIVE NODE: Corporate Firewall / GatewayH = 2.1 (Normal)
STEP 1 OF 6

Standard Egress Firewall Restrictions

Corporate firewalls block direct outbound HTTP and TCP connections (ports 80, 443) from internal workstations, but routinely allow UDP port 53 traffic to internal corporate DNS resolvers to preserve domain name resolution.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →