One Article Review
| Source |  RedTeam PL |
|---|---|
| Identifiant | 1798884 |
| Date de publication | 2020-03-18 17:56:30 (vue: 2020-07-09 15:05:43) |
| Titre | DNS for red team purposes |
| Texte | IntroductionIn the following blog post I would like to demonstrate a proof-of-concept for how red teamers can build DNS command & control (DNS C2, DNS C&C), perform DNS rebinding attack and create fast flux DNS. We will focus only on the DNS server part without building a complete working platform.This approach can also be used by |
| Envoyé | Oui |
| Condensat | $aaaa $answer; $argn $cfg $fastflux $ff $file $lines $p; $payload $query $str $v; $z $y; $aaaa $answer $answers $str $a $aaaa $answer $v $y $q for +short +short7265:6474:6561:6d2e:706c:2065:6c65:6574in 10+ 10redteaming 11redteaming 127 12redteaming 14redteaming 15if 168 170 1800 192 1;1127 1;1192 1;1we 1redteaming 24/7 3600 47; $x 5redteaming 600 6redteaming 7265:6474:6561:6d2e:706c:2065:6c65:6574 7;5192 7redteaming 7this 8redteaming 9redteaming :if ;$aaaa ; ; $aaaa ; $answer ; $answers ; $cfg ; $fastflux ; $ff ; $lines ; $payload ; $answer ; $file ; $p ; $x ; array ; file ; if ; if ;do ;doned9f7:d974:24f4:5abf:3e85:d78e:2b03:1647c9b1:3131:7a18:037a:1883:c23a:6703:16472272:aae5:cd8b:2a8a:446e:1b8a:3303:1647fa0b:3a37:aea7:b115:5b3c:b7b1:6c03:1647f572:e443:062e:d4c2:842d:0925:b503:1647fd5c:24f2:e0ad:74ab:6f03:69d8:3a03:16479802:92ab:98f7:62cd:89a9:f994:0903:16474b2e:ad03:5333:88da:e887:66dd:3803:1647d687:7205:d775:8a41:df65:f9bb:1c03:16471bfa:7f5f:c78f:9bc7:8c28:40f6:4103:1647ae03:f42e:a44c:18b0:69e7:2439:8c03:164728ad:79ab:ecf6:dad2:b552:8ceb:a603:16473d71:4eac:d366:e3ef:b979:718a:8f03:16477a89:95bf:12b8:1e50:6445:f515:9a03:16470f54:3f33:d60c:025e:e9fa:4067:6a03:16470f38:9c72:7a3d:d834:964f:71d1:9803:1647fc72:f0fa:63e1:98d2:0681:3b2b:0003:1647dead:beef:dead:beef:dead:beef:dead:beefdead:beef:dead:beef:dead:beef:dead:beefdead:beef:dead:beef:dead:beef:dead:beefour ;doneredteaming ;var === >getname >gettype >setclass >setname >setrdata >setttl >settype ^;|^$ ^expanded aaaa ability about above add additionally address addresses afford after against alert all allows also amount analysis analyze another answer anti any appended approach are array as:$ assuming attack attacked attacker attacks attacksimilar attention avoid awk balancing based bash beaconing became because been before beginning below better between bin2hex bind9 blackhole blog blue build building bullet but bypassing c&c c2at cache called can capable case cat center cfg changed char characters checksums chunk classenum::internet classic client code code:$str code:if collected com com/adamziaja/dns com/samuelwilliams/simple com/yswery/php command common communication communications complete concept configuration configured consecutives conspicuous contain contains contents control count counting course create customized d9f7:d974:24f4:5abf:3e85:d78e:2b03:1647 d9f7:d974:24f4:5abf:3e85:d78e:2b03:1647$ data date dead:beef:dead:beef:dead:beef:dead:beef deadbeef deceive decisions defenders defensive demonstrate demonstrates described details detect detected detection different dig digit digits direct directly dns dnswe doesn doh doing domain don done dump during dynamic each easily easy echo egrep eleet else encode environment eol; especially etc every everything example examples executed explain explained explode extracted fast fc72:f0fa:63e1:98d2:0681:3b2b:0003:1647 fc72:f0fa:63e1:98d2:0681:3b2b:0003 |
| Tags | Malware Threat |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.