Peculiar DNS Traffic

DNS traffic analysis can be challenging due to its high volume, but identifying abnormalities is crucial for detecting malicious activity.

---

DNS Queries

DNS queries allow clients to resolve domain names to IP addresses and vice versa.

DNS Forward Queries

In a forward lookup, the client resolves a domain name to an IP address, following these steps:

1. Query Initiation: Client queries domain, e.g., academy.hackthebox.com.

2. Local Cache Check: Checks local DNS cache; if unresolved, continues.

3. Recursive Query: Sends query to the configured DNS server.

4. Root Servers: DNS resolver queries root servers if necessary.

5. TLD Servers: Root server directs to TLD servers (e.g., .com).

6. Authoritative Servers: TLD server points to domain's authoritative server.

7. Domain’s Authoritative Servers: The resolver obtains the IP address.

8. Response: The IP address is sent back to the client.

DNS Reverse Lookups/Queries

Reverse lookups are used to find a domain name from an IP address:

1. Query Initiation: Client sends a DNS reverse query with the IP.

2. Reverse Lookup Zones: DNS resolver checks if it is authoritative.

3. PTR Record Query: Resolver searches for a PTR record.

4. Response: The FQDN is returned if a matching PTR is found.

---

DNS Record Types

Record Type	Description
A	Maps a domain name to an IPv4 address
AAAA	Maps a domain name to an IPv6 address
CNAME	Creates an alias for a domain
MX	Specifies mail server for the domain
NS	Authoritative name servers for the domain
PTR	Used in reverse queries to map IP to a domain
TXT	Specifies text associated with the domain
SOA	Administrative information about the zone

Detecting DNS Enumeration Attempts

A high volume of DNS queries from a single host may suggest DNS enumeration. Using Wireshark, filter DNS traffic as follows:

dns

If queries include ANY, this could indicate DNS enumeration, or even subdomain enumeration.

Finding DNS Tunneling

DNS tunneling can involve a significant number of TXT records from one host. Attackers may exfiltrate data by appending it to the TXT field of DNS queries.

Example of DNS Tunneling Indicators

Examine DNS traffic for unusual or unexpected text in the TXT field. Encoded or encrypted data may appear, often as base64:

1. Extracting Base64 Encoded Data:

   echo 'VTBaU1EyVXhaSFprVjNocldETnNkbVJXT1cxaU0wb3pXVmhLYTFneU1XeFlNMUp2WVZoT1ptTklTbXhrU0ZJMVdETkNjMXBYUm5wYQpXREJMQ2c9PQo=' | base64 -d

2. Handling Multi-Level Encoding:

   echo 'encoded_string' | base64 -d | base64 -d | base64 -d

   Some attackers may encode data multiple times or encrypt it, making detection harder.

Reasons for DNS Tunneling

1. Data Exfiltration: Used to covertly export data from a network.

2. Command and Control: Enables compromised systems to communicate with attacker-controlled servers, often used in botnets.

3. Firewall Bypassing: DNS tunnels can bypass firewalls or proxies focused on HTTP/HTTPS.

4. Domain Generation Algorithms (DGAs): Advanced malware uses DGAs to generate dynamic domain names, complicating detection.

The Interplanetary File System and DNS Tunneling

Advanced threat actors may use IPFS to store and retrieve malicious files, making DNS/HTTP traffic to URIs like the following noteworthy:

• IPFS Example URI:

  https://cloudflare-ipfs.com/ipfs/QmS6eyoGjENZTMxM7UdqBk6Z3U3TZPAVeJXdgp9VK4o1Sz

IPFS operates on a peer-to-peer basis, complicating detection. Regular monitoring of DNS and HTTP/HTTPS traffic is essential to mitigate these attacks.