nerdexam
EC-Council

312-50V9 · Question #87

Which of the following is a client-server tool utilized to evade firewall inspection?

The correct answer is A. tcp-over-dns. tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries and responses to bypass firewall rules that block most ports but allow DNS.

Evading IDS, Firewalls, and Honeypots

Question

Which of the following is a client-server tool utilized to evade firewall inspection?

Options

  • Atcp-over-dns
  • Bkismet
  • Cnikto
  • Dhping

How the community answered

(17 responses)
  • A
    88% (15)
  • B
    6% (1)
  • C
    6% (1)

Why each option

tcp-over-dns is a client-server tunneling tool that encapsulates TCP traffic inside DNS queries and responses to bypass firewall rules that block most ports but allow DNS.

Atcp-over-dnsCorrect

tcp-over-dns works by tunneling arbitrary TCP connections through DNS protocol traffic on port 53, which is almost universally permitted through firewalls. Because the firewall sees only DNS traffic, the TCP payload inside evades deep packet inspection. This makes it a classic covert channel and firewall evasion technique.

Bkismet

Kismet is a passive wireless network detector and sniffer used for Wi-Fi reconnaissance, not a client-server firewall evasion tool.

Cnikto

Nikto is a web server vulnerability scanner that actively probes HTTP/HTTPS services, not a tool designed for firewall tunneling or evasion.

Dhping

hping is a packet crafting and network testing utility used to craft custom TCP/IP packets, not a client-server tool for tunneling traffic to evade firewalls.

Concept tested: DNS tunneling for firewall evasion

Source: https://owasp.org/www-community/attacks/DNS_Rebinding

Topics

#tcp-over-dns#DNS tunneling#firewall evasion#covert channel

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice