Hack the Route Start free Open app Reconnaissance and exfiltration
DNS tunneling and exfiltration
Smuggling data in and out of a network by encoding it inside DNS queries, which firewalls usually let through.
Even a network that blocks direct outbound traffic almost always lets DNS resolve, so an attacker encodes stolen
data into the labels of names under a domain they control (<base32-data>.exfil.example) and reads it off their
authoritative server's log. The tell is in the pattern, not the payload: many long, high-entropy, unique subdomains of one
domain, far more than normal browsing. Defences block or sinkhole the domain, rate-limit odd query volumes, and force
DNS through an inspected resolver.