312-50V10 · Question #883
Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate data. He is using the NSTX tool for bypassing the firewalls. On whi
The correct answer is A. Port 53. DNS tunneling tools like NSTX must run on port 53 because they encapsulate arbitrary data inside DNS query and response packets to bypass firewalls.
Question
Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate data. He is using the NSTX tool for bypassing the firewalls. On which of the following ports should Robin run the NSTX tool?
Options
- APort 53
- BPort 23
- CPort 50
- DPort 80
How the community answered
(35 responses)- A94% (33)
- B3% (1)
- D3% (1)
Why each option
DNS tunneling tools like NSTX must run on port 53 because they encapsulate arbitrary data inside DNS query and response packets to bypass firewalls.
NSTX (Nameserver Transfer Protocol) encapsulates IP traffic within DNS packets to tunnel data through firewalls that permit DNS traffic. Because DNS operates on UDP/TCP port 53, NSTX must communicate over port 53 to masquerade as legitimate DNS traffic, allowing exfiltration even in restrictive firewall environments.
Port 23 is used by Telnet and is unrelated to DNS tunneling or DNS protocol traffic.
Port 50 is used by the IPsec ESP (Encapsulating Security Payload) protocol, not DNS or DNS tunneling tools.
Port 80 is the standard HTTP port; while HTTP tunneling is a separate technique, NSTX specifically uses DNS and therefore requires port 53.
Concept tested: DNS tunneling and covert data exfiltration over port 53
Source: https://www.cisa.gov/sites/default/files/publications/dns-infrastructure-security.pdf
Topics
Community Discussion
No community discussion yet for this question.