Hacker News Reader

Don't just get files, use DNS for Command and Control too.

http://blog.strategiccyber.com/2013/06/06/dns-command-and-co...

After I wrote that blog post, I also added the ability to tunnel traffic through Beacon when its checking in several times each second. Recently, I added the ability for it to download a large file, a piece at a time, with each checkin. The size of the piece depends on the data channel (DNS vs. HTTP). It's all encrypted too.

- http://blog.strategiccyber.com/2013/06/20/thatll-never-work-...

- http://blog.strategiccyber.com/2013/07/09/hacking-through-a-...

Cobalt Strike is a commercial tool, so it better include the bells and whistles. The OP does a good job of showing code that anyone can play with, right now.

Dan Kaminsky's BlackHat presentations on OzymanDNS are excellent as well.

I really like your blog post and your ideas.

With new versions of BIND 10 allowing Python scripting, PowerDNS with Lua scripting and Unbound with Python, I think we'll start seeing more corps controlling DNS queries (or attempting to do so) with whitelists/blackslists, but for the time being, things are mostly wide-open.

Reply on news.ycombinator.com