nerdexam
EC-Council

312-50V10 · Question #314

Which of the following is a client-server tool utilized to evade firewall inspection?

The correct answer is A. tcp-over-dns. tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries to bypass firewall inspection.

Evading IDS, Firewalls, and Honeypots

Question

Which of the following is a client-server tool utilized to evade firewall inspection?

Options

  • Atcp-over-dns
  • Bkismet
  • Cnikto
  • Dhping

How the community answered

(30 responses)
  • A
    90% (27)
  • B
    7% (2)
  • D
    3% (1)

Why each option

tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries to bypass firewall inspection.

Atcp-over-dnsCorrect

tcp-over-dns works by encoding TCP session data inside DNS query and response packets, which most firewalls permit outbound on UDP/TCP port 53. Because firewalls typically do not perform deep inspection of DNS traffic, this technique allows an attacker or tester to establish a covert channel that evades perimeter controls. It requires both a client component inside the restricted network and a server component on an external DNS-enabled host.

Bkismet

Kismet is a passive wireless network detector and packet sniffer; it does not tunnel traffic or evade firewalls.

Cnikto

Nikto is an open-source web server vulnerability scanner that probes HTTP/HTTPS targets; it is not a tunneling or firewall evasion tool.

Dhping

hping is a packet crafting and network testing tool used for tasks like port scanning and firewall testing, but it is not a client-server tunneling solution designed to evade firewall inspection.

Concept tested: DNS tunneling for firewall evasion

Source: https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/

Topics

#tcp-over-dns#firewall evasion#DNS tunneling#covert channel

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice