nerdexam
EC-Council

312-50V10 · Question #883

Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate data. He is using the NSTX tool for bypassing the firewalls. On whi

The correct answer is A. Port 53. DNS tunneling tools like NSTX must run on port 53 because they encapsulate arbitrary data inside DNS query and response packets to bypass firewalls.

Evading IDS, Firewalls, and Honeypots

Question

Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate data. He is using the NSTX tool for bypassing the firewalls. On which of the following ports should Robin run the NSTX tool?

Options

  • APort 53
  • BPort 23
  • CPort 50
  • DPort 80

How the community answered

(35 responses)
  • A
    94% (33)
  • B
    3% (1)
  • D
    3% (1)

Why each option

DNS tunneling tools like NSTX must run on port 53 because they encapsulate arbitrary data inside DNS query and response packets to bypass firewalls.

APort 53Correct

NSTX (Nameserver Transfer Protocol) encapsulates IP traffic within DNS packets to tunnel data through firewalls that permit DNS traffic. Because DNS operates on UDP/TCP port 53, NSTX must communicate over port 53 to masquerade as legitimate DNS traffic, allowing exfiltration even in restrictive firewall environments.

BPort 23

Port 23 is used by Telnet and is unrelated to DNS tunneling or DNS protocol traffic.

CPort 50

Port 50 is used by the IPsec ESP (Encapsulating Security Payload) protocol, not DNS or DNS tunneling tools.

DPort 80

Port 80 is the standard HTTP port; while HTTP tunneling is a separate technique, NSTX specifically uses DNS and therefore requires port 53.

Concept tested: DNS tunneling and covert data exfiltration over port 53

Source: https://www.cisa.gov/sites/default/files/publications/dns-infrastructure-security.pdf

Topics

#DNS tunneling#firewall evasion#NSTX tool#data exfiltration

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice