312-50V9 · Question #87
Which of the following is a client-server tool utilized to evade firewall inspection?
The correct answer is A. tcp-over-dns. tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries and responses to bypass firewall rules that block most ports but allow DNS.
Question
Which of the following is a client-server tool utilized to evade firewall inspection?
Options
- Atcp-over-dns
- Bkismet
- Cnikto
- Dhping
How the community answered
(17 responses)- A88% (15)
- B6% (1)
- C6% (1)
Why each option
tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries and responses to bypass firewall rules that block most ports but allow DNS.
tcp-over-dns works by tunneling arbitrary TCP connections through DNS protocol traffic on port 53, which is almost universally permitted through firewalls. Because the firewall sees only DNS traffic, the TCP payload inside evades deep packet inspection. This makes it a classic covert channel and firewall evasion technique.
Kismet is a passive wireless network detector and sniffer used for Wi-Fi reconnaissance, not a client-server firewall evasion tool.
Nikto is a web server vulnerability scanner that actively probes HTTP/HTTPS services, not a tool designed for firewall tunneling or evasion.
hping is a packet crafting and network testing utility used to craft custom TCP/IP packets, not a client-server tool for tunneling traffic to evade firewalls.
Concept tested: DNS tunneling for firewall evasion
Source: https://owasp.org/www-community/attacks/DNS_Rebinding
Topics
Community Discussion
No community discussion yet for this question.