312-50V10 · Question #314
Which of the following is a client-server tool utilized to evade firewall inspection?
The correct answer is A. tcp-over-dns. tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries to bypass firewall inspection.
Question
Which of the following is a client-server tool utilized to evade firewall inspection?
Options
- Atcp-over-dns
- Bkismet
- Cnikto
- Dhping
How the community answered
(30 responses)- A90% (27)
- B7% (2)
- D3% (1)
Why each option
tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries to bypass firewall inspection.
tcp-over-dns works by encoding TCP session data inside DNS query and response packets, which most firewalls permit outbound on UDP/TCP port 53. Because firewalls typically do not perform deep inspection of DNS traffic, this technique allows an attacker or tester to establish a covert channel that evades perimeter controls. It requires both a client component inside the restricted network and a server component on an external DNS-enabled host.
Kismet is a passive wireless network detector and packet sniffer; it does not tunnel traffic or evade firewalls.
Nikto is an open-source web server vulnerability scanner that probes HTTP/HTTPS targets; it is not a tunneling or firewall evasion tool.
hping is a packet crafting and network testing tool used for tasks like port scanning and firewall testing, but it is not a client-server tunneling solution designed to evade firewall inspection.
Concept tested: DNS tunneling for firewall evasion
Source: https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
Topics
Community Discussion
No community discussion yet for this question.